cedricAbonnel
e803d2d0a7
bootstrap.php ne suffisait pas — index.php, feed.php et sitemap.php passent par config/config.php. DATA_PATH est maintenant défini là, juste après le chargement du .env. file.php charge désormais config/config.php. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
39 lines
916 B
PHP
39 lines
916 B
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
define('BASE_PATH', realpath(__DIR__ . '/../'));
|
|
|
|
require_once BASE_PATH . '/vendor/autoload.php';
|
|
require_once BASE_PATH . '/config/config.php';
|
|
|
|
$uuid = $_GET['uuid'] ?? '';
|
|
$name = $_GET['name'] ?? '';
|
|
|
|
// Valide le format UUID v4
|
|
if (!preg_match('/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i', $uuid)) {
|
|
http_response_code(400);
|
|
exit;
|
|
}
|
|
|
|
// Sécurise le nom de fichier (pas de traversal)
|
|
$name = basename($name);
|
|
if ($name === '' || $name[0] === '.') {
|
|
http_response_code(400);
|
|
exit;
|
|
}
|
|
|
|
$path = DATA_PATH . '/' . $uuid . '/files/' . $name;
|
|
|
|
if (!is_file($path)) {
|
|
http_response_code(404);
|
|
exit;
|
|
}
|
|
|
|
$mime = mime_content_type($path) ?: 'application/octet-stream';
|
|
header('Content-Type: ' . $mime);
|
|
header('Content-Length: ' . filesize($path));
|
|
header('Cache-Control: public, max-age=31536000, immutable');
|
|
readfile($path);
|
|
exit;
|