42 lines
1.3 KiB
PHP
42 lines
1.3 KiB
PHP
<?php
|
|
/**
|
|
* This is the processor that handles the certificate download requests
|
|
* It is here to avoid direct access to the certificate download API
|
|
*/
|
|
require_once '../../../config.php';
|
|
global $WORDPRESS_STATIC_TOKEN;
|
|
// Male sure the config file is loaded and configured
|
|
if (!isset($WORDPRESS_STATIC_TOKEN)) {
|
|
header('HTTP/1.0 500 Internal Server Error');
|
|
return;
|
|
}
|
|
|
|
// Get the certificate ID from the query string
|
|
$certificate_id = $_GET['certificate_id'] ?? '';
|
|
|
|
// Check if the certificate ID is a number
|
|
if (!is_numeric($certificate_id) || $certificate_id < 1) {
|
|
header('HTTP/1.0 403 Bad Request');
|
|
return;
|
|
}
|
|
|
|
// Require a valid static token before serving certificates
|
|
if (!isset($_GET['secret_token']) || $_GET['secret_token'] !== $WORDPRESS_STATIC_TOKEN) {
|
|
header('HTTP/1.0 401 Unauthorized');
|
|
return;
|
|
}
|
|
|
|
// Check if the certificate exists in the /output/certificates folder
|
|
if (!file_exists("../output/certificates/wash_certificate_" . $certificate_id . ".pdf")) {
|
|
header('HTTP/1.0 403 Bad Request');
|
|
return;
|
|
}
|
|
|
|
// Set the headers
|
|
header('Content-Type: application/pdf');
|
|
header('Content-Disposition: attachment; filename="wash certificate ' . $certificate_id . '.pdf"');
|
|
|
|
// Output the certificate
|
|
readfile("../output/certificates/wash_certificate_" . $certificate_id . ".pdf");
|
|
exit;
|