<?php

require_once "../config.inc";

$filename_raw = $_GET['file'];

// protect against directory traversal
if (strstr($filename_raw, "/../")) {
    header("403 Forbidden");
    echo "Directory traversal not allowed";
    exit;
}

// normalize name
$root = realpath("$path_prefix/web/files");
if (!$root) {
    header("404 Not Found");
    echo "In fact, the entire upload directory ($path_prefix/web/files) doesn't seem to exist, so there's no chance of finding your file!";
    exit;
}

$filename = realpath("$root/$filename_raw");

// not found?
if (!$filename) {
    header("404 Not Found");
    echo "I looked, but couldn't find $filename_raw (realpath $root/$filename_raw)";
    exit;
}

// second security check
if (strpos($filename, $root) !== 0) {
    header("403 Forbidden");
    echo "Directory traversal forbidden.";
    exit;
}

// if we got this far, send it out.

$ctype = NULL;

if (preg_match("/(\.[A-Za-z]+)$/", $filename, $m)) {

    $map = array(
        '.wmv' => 'video/x-ms-wmv',
        '.qt' => 'video/quicktime',
        '.mov' => 'video/quicktime',
        '.avi' => 'video/x-msvideo',
        );

    $ctype = @$map[$m[1]];

}

if (!$ctype) $ctype = 'application/octet-stream';

 header("Pragma: public"); // required
 header("Expires: 0");
 header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
 header("Cache-Control: private",false); // required for certain browsers
 header("Content-Type: $ctype");
 header("Content-Disposition: attachment; filename=".basename($filename).";" );
 header("Content-Transfer-Encoding: binary");
 header("Content-Length: ".@filesize($filename));

 @readfile("$filename") or die("file not found.");
 exit;
?>