Files
api/services/nginx/app/file_server.php
T
Jeppe Bundgaard 0b566ee725 Add validation for required file parameters in file_server.php
- Added checks for missing file name and file extension.
- Improved error handling with descriptive messages for missing parameters.
2025-11-11 15:39:03 +01:00

121 lines
4.2 KiB
PHP

<?php
// Get the file name from the URL
$file = $_SERVER['REQUEST_URI'];
$isPreview = $_GET['preview'] ?? false;
// Remove query string if present
$file = strtok($file, '?');
$isPDF = false;
$isPDFStore = false;
$isAttachment = false;
// Check if the filetype is .pdf
if (preg_match('/\.pdf$/', $file)) {
$isPDF = true;
// Check if the file name contains "temp_file_"
if (!str_contains($file, 'temp_file_')) {
$isPDFStore = true;
} else {
$isAttachment = true;
}
}
// Require a filename
if (empty($file)) {
echo 'No file specified';
exit;
}
// Require an extension
if (!preg_match('/\.[a-zA-Z0-9]+$/', $file)) {
echo 'No file extension specified';
exit;
}
// Check if the file is an attachment
if (str_contains($file, 'temp_file_')) {
$isAttachment = true;
}
if ($isPDF && $isPDFStore) {
$file = str_replace('/modules/washcertificates/output/certificates/', '', $file);
// Download the file from minio, and send it to the client
$wash_certificate_store = new \classes\wash_certificate_store();
// Check if the certificate exists
if (!$wash_certificate_store->isFileInStore($file)) {
// Try the PDF store
$pdf_store = new \classes\pdf_store();
if ($pdf_store->isFileInStore(str_replace('/files/', '', $file))) {
// Download the certificate from the PDF store to /tmp
$certificate_path = $pdf_store->download(str_replace('/files/', '', $file));
// Send the certificate to the client
header('Content-Type: application/pdf');
header('Content-Disposition: inline; filename="' . str_replace('/files/', '', $file) . '"');
header('Content-Length: ' . filesize($certificate_path));
readfile($certificate_path);
// Delete the certificate from /tmp after sending it
unlink($certificate_path);
exit;
}
echo 'Certificate not found in store' . $file;
//header('HTTP/1.1 404 Not Found');
exit;
}
// Download the certificate from the store to /tmp
$certificate_path = $wash_certificate_store->download($file);
// Send the certificate to the client
header('Content-Type: application/pdf');
header('Content-Disposition: inline; filename="' . $file . '"');
header('Content-Length: ' . filesize($certificate_path));
readfile($certificate_path);
// Delete the certificate from /tmp after sending it
unlink($certificate_path);
exit;
}
// If the file is an attachment, serve it as a download
if ($isAttachment) {
$attachment_store = new \classes\attachment_store();
$file = str_replace('/files/', '', $file);
// Check if the file exists in the attachment store
if (!$attachment_store->isFileInStore($file)) {
echo 'Attachment '. $file .' not found in store';
exit;
}
// Download the file from the store to /tmp
$file_path = $attachment_store->download($file);
// Send the file to the client
if ($isPreview) {
header('Content-Type: ' . mime_content_type($file_path));
header('Content-Disposition: inline; filename="' . basename($file_path) . '"');
} else {
header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename="' . basename($file_path) . '"');
}
header('Content-Length: ' . filesize($file_path));
readfile($file_path);
// Delete the file from /tmp after sending it
unlink($file_path);
exit;
}
// Check if the file might be a temporary static file
if (!$isPDF) {
$uploads = new \classes\upload_store();
$file = str_replace('/files/', '', $file);
// Check if the file exists in the upload store
if (!$uploads->isFileInStore($file)) {
echo 'File not found in store';
exit;
}
// Download the file from the store to /tmp
$file_path = $uploads->download($file);
// Send the file to the client
$mime_type = mime_content_type($file_path);
header('Content-Type: ' . $mime_type);
header('Content-Disposition: inline; filename="' . basename($file_path) . '"');
header('Content-Length: ' . filesize($file_path));
readfile($file_path);
// Delete the file from /tmp after sending it
unlink($file_path);
exit;
}