53 lines
1.6 KiB
PHP
53 lines
1.6 KiB
PHP
<?php
|
|
require_once('include/headscript.php');
|
|
|
|
/**
|
|
* Visualizza/scarica un certificato in modo protetto.
|
|
* GET: id = idcertificateuserprofile.
|
|
* Consentito a: proprietaria del certificato, staff della scuola del certificato.
|
|
*/
|
|
$pdo = DBHandlerSelect::getInstance()->getConnection();
|
|
$id = (int) ($_GET['id'] ?? 0);
|
|
|
|
$st = $pdo->prepare("SELECT * FROM certificateuserprofile WHERE idcertificateuserprofile = ? AND idschool = ?");
|
|
$st->execute([$id, $idschool]);
|
|
$cert = $st->fetch();
|
|
|
|
$allowed = $cert && ((int) $cert['iduser'] === (int) $iduserlogin || SchoolContext::isStaff());
|
|
if (!$allowed) {
|
|
http_response_code(404);
|
|
exit('Documento non trovato.');
|
|
}
|
|
|
|
// Percorsi possibili: archivio privato (futuro) e cartella storica pubblica
|
|
$name = basename((string) $cert['filenamedocument']);
|
|
$candidates = [
|
|
dirname(__DIR__) . '/storage/app/certificates/' . (int) $cert['idschool'] . '/' . $name,
|
|
__DIR__ . '/user/document/' . $name,
|
|
];
|
|
$path = null;
|
|
foreach ($candidates as $c) {
|
|
if (is_file($c)) {
|
|
$path = $c;
|
|
break;
|
|
}
|
|
}
|
|
if (!$path) {
|
|
http_response_code(404);
|
|
exit('File non disponibile.');
|
|
}
|
|
|
|
$mime = (new finfo(FILEINFO_MIME_TYPE))->file($path);
|
|
if (!in_array($mime, ['application/pdf', 'image/jpeg', 'image/png'], true)) {
|
|
http_response_code(415);
|
|
exit('Formato non supportato.');
|
|
}
|
|
|
|
header('Content-Type: ' . $mime);
|
|
header('Content-Length: ' . filesize($path));
|
|
header('Content-Disposition: inline; filename="certificato-' . $id . '.' . pathinfo($name, PATHINFO_EXTENSION) . '"');
|
|
header('X-Content-Type-Options: nosniff');
|
|
header('Cache-Control: private, no-store');
|
|
readfile($path);
|
|
exit;
|