admin_download.php

<?php
declare(strict_types=1);

$isHttps =
  (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off')
  || (isset($_SERVER['SERVER_PORT']) && $_SERVER['SERVER_PORT'] == 443)
  || (!empty($_SERVER['HTTP_X_FORWARDED_PROTO']) && strtolower($_SERVER['HTTP_X_FORWARDED_PROTO']) === 'https');

session_name('DropzoneAdminSession');
session_start([
  'cookie_httponly' => true,
  'cookie_secure' => $isHttps,
  'cookie_samesite' => 'Lax',
]);

require_once 'inc/config.php';
require_once 'inc/helpers.php';
require_once 'inc/language.php';

define('UPLOADS_DIR', $uploadDir);
define('FILEDATA_JSON', $dataFile);

if (empty($_SESSION['logged_in'])) {
    http_response_code(403);
    exit('Forbidden');
}

function safe_uploads_join(string $rel): ?string {
    return dz_uploads_file_path($rel);
}

function pick_entry_by_path(array $data, string $path) {
    foreach ($data as $e)
        if ((string)($e['path'] ?? '') === $path) return $e;
    return null;
}

function header_sane_filename(string $fn): string {
    return dz_header_filename($fn);
}

$path = trim((string)($_GET['path'] ?? ''));
if ($path === '') {
    http_response_code(400);
    exit('Missing path');
}

$data = read_json(FILEDATA_JSON, []);
$entry = pick_entry_by_path($data, $path);
if (!$entry) {
    http_response_code(404);
    exit('Not found');
}

$abs = safe_uploads_join($path);
if (!$abs || !is_file($abs)) {
    http_response_code(404);
    exit('File missing');
}

$filename = (string)($entry['name'] ?? basename($abs));
$size = filesize($abs);
$mime = 'application/octet-stream';
if (function_exists('mime_content_type')) {
    $m = mime_content_type($abs);
    if ($m) $mime = $m;
}

header('Content-Description: File Transfer');
header('Content-Type: ' . $mime);
header('Content-Disposition: attachment; filename="' . header_sane_filename($filename) . '"');
header('Content-Transfer-Encoding: binary');
header('Content-Length: ' . $size);
header('Cache-Control: private, no-transform, no-store, must-revalidate');

$fp = fopen($abs, 'rb');
if ($fp) {
    while (!feof($fp)) {
        echo fread($fp, 8192);
        @ob_flush();
        flush();
    }
    fclose($fp);
}
exit;
?>