forked from AnttiKurittu/kirjuri
-
Notifications
You must be signed in to change notification settings - Fork 0
/
get_file.php
32 lines (29 loc) · 1.04 KB
/
get_file.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
<?php
require_once './include_functions.php';
ksess_verify(1);
ksess_validate($_GET['token']);
if (!isset($_GET['file'])) {
die;
}
$file_id = filter_numbers($_GET['file']);
$query = $kirjuri_database->prepare('SELECT name, content, size, type, request_id, hash FROM attachments WHERE id = :id');
$query->execute(array(':id' => $file_id));
$file = $query->fetch(PDO::FETCH_ASSOC);
csrf_case_validate($_GET['ct'], $file['request_id']);
verify_case_ownership($file['request_id']);
event_log_write($file['request_id'], 'File', 'Attachment downloaded: '. $file['name'] . ", sha256: ". $file['hash']);
if (!empty($file['content'])) {
header('Content-Description: File Transfer');
header('Content-Type: '.$file['type']);
header('Content-Disposition: attachment; filename="'.basename($file['name']).'"');
header('Expires: 0');
header('Cache-Control: must-revalidate');
header('Pragma: public');
header('Content-Length: ' . $file['size']);
echo gzdecode($file['content']);
die;
} else {
echo "File not found.";
die;
}
?>