Your IP : 216.73.217.117

Current Path : /var/www/cesa.co.za/cesanet/
Upload File :
Current File : /var/www/cesa.co.za/cesanet/document-pdf-proxy.php

<?php
session_start();

// Validate session and token
if (
    !isset($_SESSION["StudentID"]) || empty($_SESSION["StudentID"]) ||
    !isset($_GET['token']) || !isset($_SESSION['document_token']) ||
    $_GET['token'] !== $_SESSION['document_token']
) {
    http_response_code(403);
    die('Access denied');
}

$_GET['file'] = $_SESSION['document_token'];

// Validate file parameter
if (!isset($_GET['file']) || empty($_GET['file'])) {
    http_response_code(400);
    die('Invalid file parameter');
}

$file = $_GET['file'];
$filePath = $_SERVER['DOCUMENT_ROOT'] . '/cceadmin/documents/' . $file;

// Security checks
if (!file_exists($filePath)) {
    http_response_code(404);
    die('File not found');
}

// Prevent directory traversal
if (strpos($file, '..') !== false || strpos($file, '/') !== false) {
    http_response_code(403);
    die('Invalid file path');
}

// Check file extension
$allowedExtensions = ['pdf'];
$fileExtension = strtolower(pathinfo($file, PATHINFO_EXTENSION));
if (!in_array($fileExtension, $allowedExtensions)) {
    http_response_code(403);
    die('Invalid file type');
}

// Get file info
$fileSize = filesize($filePath);
$fileTime = filemtime($filePath);

// Set headers to prevent caching and downloading
header('Content-Type: application/pdf');
header('Content-Length: ' . $fileSize);
header('Content-Disposition: inline; filename="' . basename($file) . '"');
header('Cache-Control: no-cache, no-store, must-revalidate');
header('Pragma: no-cache');
header('Expires: 0');

// Additional security headers
header('X-Content-Type-Options: nosniff');
header('X-Frame-Options: SAMEORIGIN');
header('X-XSS-Protection: 1; mode=block');

// Log access for audit trail
$logEntry = date('Y-m-d H:i:s') . ' - StudentID: ' . $_SESSION["StudentID"] . ' - File: ' . $file . ' - IP: ' . $_SERVER['REMOTE_ADDR'] . "\n";
file_put_contents($_SERVER['DOCUMENT_ROOT'] . '/logs/pdf_access.log', $logEntry, FILE_APPEND | LOCK_EX);

// Output the file
readfile($filePath);
exit;