62 lines
1.9 KiB
PHP
62 lines
1.9 KiB
PHP
<?php
|
|
require __DIR__ . '/_bootstrap.php';
|
|
|
|
/**
|
|
* @OA\Get(
|
|
* path="/document-file.php",
|
|
* tags={"Documents"},
|
|
* summary="Download an uploaded file",
|
|
* description="Access: home/owner owner or accepted share.",
|
|
* security={{"bearerAuth":{}}},
|
|
* @OA\Parameter(name="id", in="query", required=true, @OA\Schema(type="integer"),
|
|
* description="doc_storage.id"),
|
|
* @OA\Response(response=200, description="Binary file",
|
|
* @OA\MediaType(mediaType="application/octet-stream",
|
|
* @OA\Schema(type="string", format="binary"))),
|
|
* @OA\Response(response=403, ref="#/components/responses/Forbidden"),
|
|
* @OA\Response(response=404, ref="#/components/responses/NotFound")
|
|
* )
|
|
*/
|
|
require_method('GET');
|
|
$user = require_auth($pdo);
|
|
$config = require __DIR__ . '/config.php';
|
|
$id = (int) query('id', 0);
|
|
|
|
if ($id <= 0) {
|
|
json_error(422, 'id is required');
|
|
}
|
|
|
|
$stmt = $pdo->prepare('SELECT * FROM doc_storage WHERE id = ? LIMIT 1');
|
|
$stmt->execute([$id]);
|
|
$file = $stmt->fetch();
|
|
|
|
if (!$file) {
|
|
json_error(404, 'File not found');
|
|
}
|
|
|
|
// Access check: home file or owner file.
|
|
$allowed = false;
|
|
if (!empty($file['idhome'])) {
|
|
$allowed = user_can_access_home($pdo, $user, (int) $file['idhome']);
|
|
$baseDir = $config['homedocs_dir'];
|
|
} elseif (!empty($file['owner_id'])) {
|
|
$allowed = user_owns_owner($pdo, $user, (int) $file['owner_id']);
|
|
$baseDir = $config['persondocs_dir'];
|
|
}
|
|
|
|
if (!$allowed) {
|
|
json_error(403, 'No access to this file');
|
|
}
|
|
|
|
$path = ($baseDir ?? '') . '/' . basename((string) $file['filename']);
|
|
if (!is_file($path)) {
|
|
json_error(404, 'File missing on disk');
|
|
}
|
|
|
|
// Serve the binary file (override bootstrap JSON header).
|
|
header('Content-Type: ' . (mime_content_type($path) ?: 'application/octet-stream'));
|
|
header('Content-Disposition: attachment; filename="' . basename((string) $file['filename']) . '"');
|
|
header('Content-Length: ' . filesize($path));
|
|
readfile($path);
|
|
exit;
|