rsp.setHeader("Cache-Control", "no-cache, must-revalidate");
OutputStream out;
ZipOutputStream zo;
final MimeType contentType = registry.getMimeType(path, raw);
if (!registry.isSafeInline(contentType)) {
// The content may not be safe to transmit inline, as a browser might
// interpret it as HTML or JavaScript hosted by this site. Such code
// might then run in the site's security domain, and may be able to use
// the user's cookies to perform unauthorized actions.
//
// Usually, wrapping the content into a ZIP file forces the browser to
// save the content to the local system instead.
//
rsp.setContentType(ZIP.toString());
rsp.setHeader("Content-Disposition", "attachment; filename=\""
+ safeFileName(path, suffix) + ".zip" + "\"");
zo = new ZipOutputStream(rsp.getOutputStream());
final ZipEntry e = new ZipEntry(safeFileName(path, rand(req, suffix)));
e.setComment(fromCommit.name() + ":" + path);
e.setSize(blobLoader.getSize());
e.setTime(when);
zo.putNextEntry(e);
out = zo;
} else {
rsp.setContentType(contentType.toString());
rsp.setHeader("Content-Length", "" + blobLoader.getSize());
out = rsp.getOutputStream();
zo = null;
}