import fogli di lavoro

public/userarea/download_worksheet_file.php

@@ -0,0 +1,51 @@
+<?php
+
+/**
+ * download_worksheet_file.php?id=WORKSHEET_ID
+ * -------------------------------------------------------------------------
+ * Restituisce il file Excel di origine allegato a un foglio di lavoro,
+ * con il nome file originale. Protetto contro path-traversal.
+ * -------------------------------------------------------------------------
+ */
+
+include('include/headscript.php');
+
+$id = isset($_GET['id']) && is_numeric($_GET['id']) ? (int)$_GET['id'] : 0;
+if ($id <= 0) {
+    http_response_code(400);
+    exit('ID non valido');
+}
+
+$db  = DBHandlerSelect::getInstance();
+$pdo = $db->getConnection();
+
+$stmt = $pdo->prepare("SELECT source_xlsx_name, source_xlsx_path FROM work_sheets WHERE id = ?");
+$stmt->execute([$id]);
+$row = $stmt->fetch(PDO::FETCH_ASSOC);
+
+if (!$row || empty($row['source_xlsx_path'])) {
+    http_response_code(404);
+    exit('Nessun file allegato a questo foglio');
+}
+
+// Risoluzione sicura: il file deve stare dentro uploads/worksheets
+$abs     = __DIR__ . '/' . $row['source_xlsx_path'];
+$real    = realpath($abs);
+$baseDir = realpath(__DIR__ . '/uploads/worksheets');
+
+if ($real === false || $baseDir === false || strpos($real, $baseDir) !== 0 || !is_file($real)) {
+    http_response_code(404);
+    exit('File non trovato');
+}
+
+$downloadName = $row['source_xlsx_name'] !== '' ? $row['source_xlsx_name'] : basename($real);
+$asciiName    = preg_replace('/[^A-Za-z0-9._-]/', '_', $downloadName);
+
+header('Content-Type: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet');
+header("Content-Disposition: attachment; filename=\"{$asciiName}\"; filename*=UTF-8''" . rawurlencode($downloadName));
+header('Content-Length: ' . filesize($real));
+header('X-Content-Type-Options: nosniff');
+header('Cache-Control: private, max-age=0, must-revalidate');
+
+readfile($real);
+exit;