15 lines
820 B
PHP
15 lines
820 B
PHP
<?php
|
|
if (session_status() !== PHP_SESSION_ACTIVE) session_start();
|
|
if (empty($_SESSION['role']) || !in_array('admin',(array)$_SESSION['role'],true)) { http_response_code(403); exit('Forbidden'); }
|
|
if (empty($_SESSION['csrf_token']) || !hash_equals($_SESSION['csrf_token'], $_GET['csrf'] ?? '')) { http_response_code(400); exit('CSRF'); }
|
|
|
|
$siteRoot=realpath(__DIR__.'/../../'); $dir=$siteRoot.'/backups/db';
|
|
$f=basename($_GET['f'] ?? ''); $path=realpath($dir.'/'.$f);
|
|
if(!$path || !str_starts_with($path, realpath($dir)) || !is_file($path)){ http_response_code(404); exit('Not found'); }
|
|
|
|
while(ob_get_level()) ob_end_clean();
|
|
header('Content-Type: application/octet-stream');
|
|
header('Content-Disposition: attachment; filename="'.basename($path).'"');
|
|
header('Content-Length: '.filesize($path));
|
|
readfile($path); exit;
|