📄 File: download.php

Path: /home2/outerorb/emp.outerorbittech.in/admin/download.php

Size: 3.29 KB

Permissions: 0666

<?php
require __DIR__ . '/../includes/helpers.php';

$mode = ($_GET['mode'] ?? '') === 'inline' ? 'inline' : 'attachment';

// For inline requests (img src / object data) a redirect produces broken images.
// Return a proper 403/404 status instead so the browser shows a clean broken-image icon.
if (!is_admin()) {
    if ($mode === 'inline') {
        http_response_code(403);
        exit;
    }
    header('Location: ' . base_url() . 'index.php');
    exit;
}

$id = isset($_GET['id']) ? (int) $_GET['id'] : 0;
$type = $_GET['type'] ?? '';

$columns = [
    'aadhaar' => ['col' => 'aadhaar_path', 'label' => 'aadhaar', 'part' => null],
    'aadhaar_front' => ['col' => 'aadhaar_path', 'label' => 'aadhaar_front', 'part' => 'front'],
    'aadhaar_back' => ['col' => 'aadhaar_path', 'label' => 'aadhaar_back', 'part' => 'back'],
    'pan' => ['col' => 'pan_path', 'label' => 'pan'],
    'qualification' => ['col' => 'qualification_path', 'label' => 'qualification'],
    'tenth_marksheet' => ['col' => 'tenth_marksheet_path', 'label' => 'tenth_marksheet'],
    'twelfth_marksheet' => ['col' => 'twelfth_marksheet_path', 'label' => 'twelfth_marksheet'],
    'bank_proof' => ['col' => 'bank_proof_path', 'label' => 'bank_proof'],
    'photo' => ['col' => 'photo_path', 'label' => 'photo'],
];

if (!$id || !isset($columns[$type])) {
    if ($mode === 'inline') { http_response_code(400); exit; }
    redirect_with_message('dashboard.php', 'Invalid download request.', 'error');
}

$pdo = db();
$stmt = $pdo->prepare('SELECT ' . $columns[$type]['col'] . ', department FROM employees WHERE id = ?');
$stmt->execute([$id]);
$fileRow = $stmt->fetch();

if (!$fileRow) {
    if ($mode === 'inline') { http_response_code(404); exit; }
    redirect_with_message('dashboard.php', 'Record not found.', 'error');
}

enforce_department_access($fileRow);

$config = app_config();
$uploadDir = realpath($config['uploads']['dir']);

if (isset($columns[$type]['part']) && $columns[$type]['part'] !== null) {
    $aadhaarPaths = parse_aadhaar_paths($fileRow[$columns[$type]['col']] ?? '');
    $candidate = $aadhaarPaths[$columns[$type]['part']] ?? null;
    $filePath = $candidate ? resolve_upload_path($candidate) : null;
    $filePath = $filePath ? realpath($filePath) : false;
} elseif ($type === 'aadhaar') {
    $aadhaarPaths = parse_aadhaar_paths($fileRow[$columns[$type]['col']] ?? '');
    $primary = aadhaar_primary_path($aadhaarPaths);
    $resolved = $primary ? resolve_upload_path($primary) : null;
    $filePath = $resolved ? realpath($resolved) : false;
} else {
    $resolved = resolve_upload_path($fileRow[$columns[$type]['col']] ?? null);
    $filePath = $resolved ? realpath($resolved) : false;
}

if (!$filePath || !$uploadDir || strpos($filePath, $uploadDir) !== 0 || !file_exists($filePath)) {
    if ($mode === 'inline') { http_response_code(404); exit; }
    redirect_with_message('dashboard.php', 'File not available.', 'error');
}

$filename = $columns[$type]['label'] . '_' . $id . '_' . basename($filePath);
$mime = detect_mime_type($filePath);

header('Content-Description: File Transfer');
header('Content-Type: ' . $mime);
header('Content-Disposition: ' . $mode . '; filename="' . $filename . '"');
header('Content-Length: ' . filesize($filePath));
readfile($filePath);
exit;

← Back to Directory Edit File 🔒 Chmod