41 lines
919 B
PHP
41 lines
919 B
PHP
<?php
|
|
if (!defined('BASEPATH')) exit('No direct script access allowed');
|
|
|
|
/*
|
|
* InvoicePlane
|
|
*
|
|
* @author InvoicePlane Developers & Contributors
|
|
* @copyright Copyright (c) 2012 - 2017 InvoicePlane.com
|
|
* @license https://invoiceplane.com/license.txt
|
|
* @link https://invoiceplane.com
|
|
*/
|
|
|
|
/**
|
|
* Class Guest
|
|
*/
|
|
class Get extends Base_Controller
|
|
{
|
|
public function attachment($filename)
|
|
{
|
|
$path = UPLOADS_FOLDER . 'customer_files/';
|
|
$filePath = $path . $filename;
|
|
|
|
if (strpos(realpath($filePath), $path) !== 0) {
|
|
header("Status: 403 Forbidden");
|
|
echo '<h1>Forbidden</h1>';
|
|
return;
|
|
}
|
|
|
|
$filePath = realpath($filePath);
|
|
|
|
if (!file_exists($filePath)) {
|
|
show_404();
|
|
return;
|
|
}
|
|
|
|
header("Content-Type: " . mime_content_type($filePath));
|
|
echo file_get_contents($filePath);
|
|
}
|
|
|
|
}
|