68 lines
2.2 KiB
PHP
68 lines
2.2 KiB
PHP
<?php
|
|
declare(strict_types=1);
|
|
|
|
require_once __DIR__ . '/../modules/shared/db.php';
|
|
require_once __DIR__ . '/../modules/shared/auth/service.php';
|
|
|
|
$requestMethod = strtoupper((string) ($_SERVER['REQUEST_METHOD'] ?? 'GET'));
|
|
if ($requestMethod !== 'GET') {
|
|
http_response_code(405);
|
|
header('Allow: GET');
|
|
echo 'Methode nicht erlaubt.';
|
|
exit;
|
|
}
|
|
|
|
$env = expand_env_values(parse_env_file(__DIR__ . '/../.env'));
|
|
$pdo = connect_database($env);
|
|
auth_bootstrap_session();
|
|
auth_require_user($pdo);
|
|
|
|
$documentRoot = rtrim(env_value('HERMES_DOCUMENT_ROOT', $env), DIRECTORY_SEPARATOR);
|
|
if ($documentRoot === '' || !str_starts_with($documentRoot, DIRECTORY_SEPARATOR)) {
|
|
http_response_code(500);
|
|
echo 'Dokumentablage ist nicht konfiguriert.';
|
|
exit;
|
|
}
|
|
|
|
$resolvedRoot = realpath($documentRoot);
|
|
$relativePath = (string) ($_GET['path'] ?? '');
|
|
|
|
if ($resolvedRoot === false || !is_dir($resolvedRoot) || $relativePath === '' || str_contains($relativePath, "\0") || str_contains($relativePath, '\\') || str_starts_with($relativePath, '/')) {
|
|
http_response_code(404);
|
|
echo 'Dokument nicht gefunden.';
|
|
exit;
|
|
}
|
|
|
|
$segments = explode('/', $relativePath);
|
|
foreach ($segments as $segment) {
|
|
if ($segment === '' || $segment === '.' || $segment === '..') {
|
|
http_response_code(404);
|
|
echo 'Dokument nicht gefunden.';
|
|
exit;
|
|
}
|
|
}
|
|
|
|
$resolvedFile = realpath($resolvedRoot . DIRECTORY_SEPARATOR . $relativePath);
|
|
$rootPrefix = $resolvedRoot . DIRECTORY_SEPARATOR;
|
|
if ($resolvedFile === false || !is_file($resolvedFile) || !is_readable($resolvedFile) || !str_starts_with($resolvedFile, $rootPrefix)) {
|
|
http_response_code(404);
|
|
echo 'Dokument nicht gefunden.';
|
|
exit;
|
|
}
|
|
|
|
$fileSize = filesize($resolvedFile);
|
|
$mimeType = mime_content_type($resolvedFile);
|
|
if ($fileSize === false || $mimeType === false) {
|
|
http_response_code(500);
|
|
echo 'Dokument konnte nicht bereitgestellt werden.';
|
|
exit;
|
|
}
|
|
|
|
$downloadName = basename($resolvedFile);
|
|
header('Content-Type: ' . $mimeType);
|
|
header('Content-Length: ' . (string) $fileSize);
|
|
header("Content-Disposition: attachment; filename*=UTF-8''" . rawurlencode($downloadName));
|
|
header('Cache-Control: private, no-store');
|
|
header('X-Content-Type-Options: nosniff');
|
|
readfile($resolvedFile);
|