1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
|
<?php
session_start(); // Start Session
require("configure.php");
$id = htmlspecialchars($_GET["id"],ENT_QUOTES);
if(isSet($_SESSION['loginname']) && !empty($_GET["id"])) {
$id_check_sql = "SELECT * FROM file_content WHERE hash=:hash";
$id_check = Db::getDbh()->prepare($id_check_sql);
$id_check->execute(array(":hash" => $id));
if( $error = $id_check->getError(array(":hash" => $id)) ){
var_dump($error);
}
$id_check_count = $id_check->rowCount();
if ($id_check_count>0){
$row_id_check = $id_check->fetch(PDO::FETCH_ASSOC);
$user_role_sql = "SELECT * FROM file_role_user WHERE userid=:userid";
$user_role = Db::getDbh()->prepare($user_role_sql);
$user_role->execute(array(":userid" => $_SESSION['loginid']));
if( $error = $user_role->getError(array(":userid" => $_SESSION['loginid'])) ){
var_dump($error);
}
$row_user_role = $user_role->fetch(PDO::FETCH_ASSOC);
$permission_check_sql = "SELECT * FROM file_folder_permission WHERE folderid=:folderid AND roleid=:roleid AND p_read = '1'";
$permission_check = Db::getDbh()->prepare($permission_check_sql);
$permission_check->execute(array(":folderid" => $row_id_check{'folderid'}, ":roleid" => $row_user_role{'roleid'}));
if( $error = $permission_check->getError(array(":folderid" => $row_id_check{'folderid'}, ":roleid" => $row_user_role{'roleid'})) ){
var_dump($error);
}
$permission_check_count = $permission_check->rowCount();
$company_check_sql = "SELECT * FROM file_company_user WHERE userid=:userid AND companyid=:companyid";
$company_check = Db::getDbh()->prepare($company_check_sql);
$company_check->execute(array(":userid" => $_SESSION['loginid'], ":companyid" => $row_id_check{'companyid'}));
if( $error = $company_check->getError(array(":userid" => $_SESSION['loginid'], ":companyid" => $row_id_check{'companyid'})) ){
var_dump($error);
}
$company_check_count = $company_check->rowCount();
if ($permission_check_count > 0 && $company_check_count > 0 || $_SESSION['role'] == 'Superadmin' || $_SESSION['role'] == 'Admin'){
require("mime_type_lib.php");
$mime = get_file_mime_type("file/".$row_id_check{'filename'});
header("Content-type: ".$mime);
header("Content-Disposition: attachment; filename=".$row_id_check{'title'}.".".$row_id_check{'extension'});
echo file_get_contents("file/".$row_id_check{'filename'});
//readfile($file); // if it's php include it. you may need to extend this code
} else {
echo "You Do Not Have Permission To Download.";
exit;
}
} else {
echo "File Not Found!";
exit;
}
$dbh = null;
} else {
// bad auth error
header("Location: index.php");
}
?>
|