

@access.cookie
@access.public
@loadmodel(model='item', level=AccessType.READ)
@describeRoute(Description('Download the contents of an item.').param('id', 'The ID of the item.', paramType='path').param('format', "If unspecified, items with one file are downloaded as that file, and other items are downloaded as a zip archive.  If 'zip', a zip archive is always sent.", required=False).param('contentDisposition', 'Specify the Content-Disposition response header disposition-type value, only applied for single file items.', required=False, enum=['inline', 'attachment'], default='attachment').errorResponse('ID was invalid.').errorResponse('Read access was denied for the item.', 403))
def download(self, item, params):
    offset = int(params.get('offset', 0))
    user = self.getCurrentUser()
    files = list(self.model('item').childFiles(item=item, limit=2))
    format = params.get('format', '')
    if (format not in (None, '', 'zip')):
        raise RestException('Unsupported format.')
    if ((len(files) == 1) and (format != 'zip')):
        contentDisp = params.get('contentDisposition', None)
        if ((contentDisp is not None) and (contentDisp not in {'inline', 'attachment'})):
            raise RestException(('Unallowed contentDisposition type "%s".' % contentDisp))
        return self.model('file').download(files[0], offset, contentDisposition=params)
    else:
        return self._downloadMultifileItem(item, user)

dataset/ETHPy150Open girder/girder/girder/api/v1/item.py Item.download/VarMisuse@267/481 `contentDisp`->`params`