()
| 18504 | conn = db_connect() |
| 18505 | row = conn.execute( |
| 18506 | "SELECT a.id, a.filename_enc, a.mime_enc, a.stored_path, a.report_id FROM report_attachments a JOIN reports r ON r.id=a.report_id WHERE a.id=?", |
| 18507 | (aid,), |
| 18508 | ).fetchone() |
| 18509 | conn.close() |
| 18510 | safe_path = _safe_report_att_path(row["stored_path"]) if row else None |
| 18511 | if not row or not safe_path: |
| 18512 | abort(404) |
| 18513 | try: |
| 18514 | filename = aesgcm_decrypt_text(row["filename_enc"]) |
| 18515 | except Exception: |
| 18516 | filename = "attachment" |
| 18517 | try: |
| 18518 | mime = aesgcm_decrypt_text(row["mime_enc"]) |
| 18519 | except Exception: |
| 18520 | mime = "application/octet-stream" |
| 18521 | filename = secure_filename(filename or "attachment") or "attachment" |
| 18522 | resp = send_file(safe_path, mimetype=mime, as_attachment=True, download_name=filename, conditional=True, max_age=0) |
| 18523 | resp.headers["Cache-Control"] = "no-store" |
| 18524 | resp.headers["X-Download-Options"] = "noopen" |
| 18525 | return resp |
| 18526 | |
| 18527 | |
| 18528 | _DISCUSS_ROW_TEMPLATE = r""" |
no test coverage detected