128af4b67SAndreas Gohr<?php 228af4b67SAndreas Gohr 305f444a4SAndreas Gohr// phpcs:disable PSR1.Files.SideEffects.FoundWithSymbols 405f444a4SAndreas Gohr 528af4b67SAndreas Gohruse dokuwiki\plugin\filelist\Path; 628af4b67SAndreas Gohr 728af4b67SAndreas Gohrif (!defined('DOKU_INC')) define('DOKU_INC', __DIR__ . '/../../../'); 828af4b67SAndreas Gohrif (!defined('NOSESSION')) define('NOSESSION', true); // we do not use a session or authentication here (better caching) 928af4b67SAndreas Gohrif (!defined('DOKU_DISABLE_GZIP_OUTPUT')) define('DOKU_DISABLE_GZIP_OUTPUT', 1); // we gzip ourself here 1028af4b67SAndreas Gohrrequire_once(DOKU_INC . 'inc/init.php'); 1128af4b67SAndreas Gohr 1228af4b67SAndreas Gohrglobal $INPUT; 1328af4b67SAndreas Gohr 1428af4b67SAndreas Gohr$syntax = plugin_load('syntax', 'filelist'); 1528af4b67SAndreas Gohrif (!$syntax) die('plugin disabled?'); 1628af4b67SAndreas Gohr 1728af4b67SAndreas Gohr$pathUtil = new Path($syntax->getConf('paths')); 1828af4b67SAndreas Gohr$path = $INPUT->str('root') . $INPUT->str('file'); 1928af4b67SAndreas Gohr 2028af4b67SAndreas Gohrtry { 2128af4b67SAndreas Gohr $pathInfo = $pathUtil->getPathInfo($path, false); 22*e82754c5SAndreas Gohr if ($pathUtil::isWikiControlled($pathInfo['path'])) { 23*e82754c5SAndreas Gohr throw new Exception('Access to wiki files is not allowed'); 24*e82754c5SAndreas Gohr } 25*e82754c5SAndreas Gohr 2628af4b67SAndreas Gohr if (!is_readable($pathInfo['path'])) { 2728af4b67SAndreas Gohr header('Content-Type: text/plain'); 2828af4b67SAndreas Gohr http_status(404); 2928af4b67SAndreas Gohr echo 'Path not readable: ' . $pathInfo['path']; 3028af4b67SAndreas Gohr exit; 3128af4b67SAndreas Gohr } 3228af4b67SAndreas Gohr [$ext, $mime, $download] = mimetype($pathInfo['path'], false); 3328af4b67SAndreas Gohr $basename = basename($pathInfo['path']); 3428af4b67SAndreas Gohr header('Content-Type: ' . $mime); 3528af4b67SAndreas Gohr if ($download) { 3628af4b67SAndreas Gohr header('Content-Disposition: attachment; filename="' . $basename . '"'); 3728af4b67SAndreas Gohr } 3828af4b67SAndreas Gohr http_sendfile($pathInfo['path']); 3928af4b67SAndreas Gohr readfile($pathInfo['path']); 4028af4b67SAndreas Gohr} catch (Exception $e) { 4128af4b67SAndreas Gohr header('Content-Type: text/plain'); 4228af4b67SAndreas Gohr http_status(403); 4328af4b67SAndreas Gohr echo $e->getMessage(); 4428af4b67SAndreas Gohr exit; 4528af4b67SAndreas Gohr} 46