32 lines
1.2 KiB
PHP
32 lines
1.2 KiB
PHP
<?php
|
|
require_once __DIR__ . '/../../includes/init_praticien.php';
|
|
|
|
$praticien_id = (int)($_SESSION['reference_id'] ?? 0);
|
|
$file_id = (int)($_GET['id'] ?? 0);
|
|
if ($praticien_id<=0 || $file_id<=0) { http_response_code(400); exit('Bad request'); }
|
|
|
|
// Vérifie la propriété via jointure
|
|
$sql = "SELECT f.path, f.mime, f.size_bytes
|
|
FROM client_suivi_files f
|
|
JOIN client_suivi s ON s.id=f.entry_id
|
|
JOIN client_dossiers d ON d.id=s.dossier_id
|
|
WHERE f.id=:id AND d.praticien_id=:p AND d.archived_at IS NULL
|
|
LIMIT 1";
|
|
$st = $pdo->prepare($sql);
|
|
$st->execute([':id'=>$file_id, ':p'=>$praticien_id]);
|
|
$row = $st->fetch(PDO::FETCH_ASSOC);
|
|
if (!$row) { http_response_code(403); exit('Forbidden'); }
|
|
|
|
$rel = (string)$row['path'];
|
|
$abs = rtrim((string)$_SERVER['DOCUMENT_ROOT'], '/').$rel;
|
|
if (!is_file($abs) || !is_readable($abs)) { http_response_code(404); exit('Not found'); }
|
|
|
|
$mime = $row['mime'] ?: 'application/octet-stream';
|
|
$dlName = basename($rel);
|
|
|
|
header('Content-Type: '.$mime);
|
|
header('Content-Length: '.filesize($abs));
|
|
header('Content-Disposition: attachment; filename="'.rawurlencode($dlName).'"');
|
|
header('X-Content-Type-Options: nosniff');
|
|
readfile($abs);
|