Your IP : 216.73.217.79

Current Path : /var/www/cesa.co.za/cceconvenors/
Upload File :
Current File : /var/www/cesa.co.za/cceconvenors/document-pdf-proxy.php

<?php
session_start();
include_once("ewcfg7.php");

if (!isset($_SESSION[EW_SESSION_STATUS]) || ($_SESSION[EW_SESSION_STATUS] != "login")) {
    http_response_code(403);
    die('Access denied');
}

$token = isset($_GET['token']) ? (string) $_GET['token'] : '';
$source = isset($_GET['source']) ? (string) $_GET['source'] : '';
$sessionToken = isset($_SESSION['convenor_document_token']) ? (string) $_SESSION['convenor_document_token'] : '';
$sessionSource = isset($_SESSION['convenor_document_source']) ? (string) $_SESSION['convenor_document_source'] : '';

if ($token === '' || $sessionToken === '' || $token !== $sessionToken || $source !== $sessionSource) {
    http_response_code(403);
    die('Access denied');
}

if (strpos($sessionToken, '..') !== false || strpos($sessionToken, '/') !== false || strpos($sessionToken, '\\') !== false) {
    http_response_code(403);
    die('Invalid file path');
}

$allowedSources = array('assignmentsupload', 'documents');
if (!in_array($source, $allowedSources, true)) {
    http_response_code(403);
    die('Invalid source');
}

$baseDir = ($source === 'documents') ? '/cceadmin/documents/' : '/cceadmin/assignmentsupload/';
$filePath = $_SERVER['DOCUMENT_ROOT'] . $baseDir . $sessionToken;

if (!file_exists($filePath)) {
    http_response_code(404);
    die('File not found');
}

if (strtolower(pathinfo($sessionToken, PATHINFO_EXTENSION)) !== 'pdf') {
    http_response_code(403);
    die('Invalid file type');
}

header('Content-Type: application/pdf');
header('Content-Length: ' . filesize($filePath));
header('Content-Disposition: inline; filename="' . basename($sessionToken) . '"');
header('Cache-Control: no-cache, no-store, must-revalidate');
header('Pragma: no-cache');
header('Expires: 0');
header('X-Content-Type-Options: nosniff');
header('X-Frame-Options: SAMEORIGIN');

readfile($filePath);
exit;