32 lines
750 B
PHP
32 lines
750 B
PHP
|
<?php
|
||
|
|
$rootDir = realpath("/home/surillya");
|
||
|
|
|
||
|
|
$query = $_GET['q'] ?? '';
|
||
|
|
|
||
|
|
$cleanQuery = preg_replace('#/+#', '/', ltrim($query, '/'));
|
||
|
|
|
||
|
|
$targetPath = $rootDir . DIRECTORY_SEPARATOR . $cleanQuery;
|
||
|
|
|
||
|
|
$requestedPath = realpath($targetPath);
|
||
|
|
|
||
|
|
if (
|
||
|
|
!$requestedPath ||
|
||
|
|
strpos($requestedPath, $rootDir) !== 0 ||
|
||
|
|
!is_file($requestedPath)
|
||
|
|
) {
|
||
|
|
http_response_code(404);
|
||
|
|
echo "File not found or access denied.";
|
||
|
|
exit;
|
||
|
|
}
|
||
|
|
|
||
|
|
$escapedPath = escapeshellarg($requestedPath);
|
||
|
|
$mime = trim(shell_exec("file -b --mime-type $escapedPath"));
|
||
|
|
|
||
|
|
header("Content-Type: $mime");
|
||
|
|
header("Content-Length: " . filesize($requestedPath));
|
||
|
|
header("Content-Disposition: inline; filename=\"" . basename($requestedPath) . "\"");
|
||
|
|
|
||
|
|
readfile($requestedPath);
|
||
|
|
exit;
|
||
|
|
?>
|