52 lines
1.8 KiB
PHP
52 lines
1.8 KiB
PHP
<?php
|
|
|
|
/**
|
|
* download_worksheet_file.php?id=WORKSHEET_ID
|
|
* -------------------------------------------------------------------------
|
|
* Restituisce il file Excel di origine allegato a un foglio di lavoro,
|
|
* con il nome file originale. Protetto contro path-traversal.
|
|
* -------------------------------------------------------------------------
|
|
*/
|
|
|
|
include('include/headscript.php');
|
|
|
|
$id = isset($_GET['id']) && is_numeric($_GET['id']) ? (int)$_GET['id'] : 0;
|
|
if ($id <= 0) {
|
|
http_response_code(400);
|
|
exit('ID non valido');
|
|
}
|
|
|
|
$db = DBHandlerSelect::getInstance();
|
|
$pdo = $db->getConnection();
|
|
|
|
$stmt = $pdo->prepare("SELECT source_xlsx_name, source_xlsx_path FROM work_sheets WHERE id = ?");
|
|
$stmt->execute([$id]);
|
|
$row = $stmt->fetch(PDO::FETCH_ASSOC);
|
|
|
|
if (!$row || empty($row['source_xlsx_path'])) {
|
|
http_response_code(404);
|
|
exit('Nessun file allegato a questo foglio');
|
|
}
|
|
|
|
// Risoluzione sicura: il file deve stare dentro uploads/worksheets
|
|
$abs = __DIR__ . '/' . $row['source_xlsx_path'];
|
|
$real = realpath($abs);
|
|
$baseDir = realpath(__DIR__ . '/uploads/worksheets');
|
|
|
|
if ($real === false || $baseDir === false || strpos($real, $baseDir) !== 0 || !is_file($real)) {
|
|
http_response_code(404);
|
|
exit('File non trovato');
|
|
}
|
|
|
|
$downloadName = $row['source_xlsx_name'] !== '' ? $row['source_xlsx_name'] : basename($real);
|
|
$asciiName = preg_replace('/[^A-Za-z0-9._-]/', '_', $downloadName);
|
|
|
|
header('Content-Type: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet');
|
|
header("Content-Disposition: attachment; filename=\"{$asciiName}\"; filename*=UTF-8''" . rawurlencode($downloadName));
|
|
header('Content-Length: ' . filesize($real));
|
|
header('X-Content-Type-Options: nosniff');
|
|
header('Cache-Control: private, max-age=0, must-revalidate');
|
|
|
|
readfile($real);
|
|
exit;
|