include("db.php");
function secq($str) { $str = stripslashes($str); $str = mysql_real_escape_string($str); return $str; }
//------------------------------------------------------------------------------------------------------------------------------
session_start();
$qres = mysql_query("SELECT * FROM pages WHERE page='working'",$db) or die(mysql_error());
$page = mysql_fetch_assoc($qres);
if ($page['data'] == "working")
{ if (isset($_SESSION['username']) && isset($_SESSION['password']))
{ if (($_SESSION['access'] == "adm") || ($_SESSION['access'] == "pch")); else header("location:index.php?page=maintenance"); }
else header("location:index.php?page=maintenance"); }
//------------------------------------------------------------------------------------------------------------------------------
$fileN = secq($_GET['file']);
$invalidFile = true;
if ($fileN != "")
{ if ((preg_match("/^(cards|fly|ps)[0-9]{4}\.(xml|pdf)$/i",$fileN))) $invalidFile = false;
switch($fileN)
{ case "CardsFly1.xsl": $invalidFile = false; break;
case "cdd.dtd": $invalidFile = false; break;
case "CDD.xml": $invalidFile = false; break;
case "dalf.dtd": $invalidFile = false; break;
case "Manual_CARDS-FLY.pdf": $invalidFile = false; break;
case "CardsXML.zip": $invalidFile = false; break;
case "CardsPDF.zip": $invalidFile = false; break;
case "FlyXML.zip": $invalidFile = false; break;
case "FlyPDF.zip": $invalidFile = false; break;
case "PSXML.zip": $invalidFile = false; break;
case "PSPDF.zip": $invalidFile = false; break;
// case "": $invalidFile = false; break;
}
}
if ($invalidFile)
{ include("settings.php"); ?>
echo "".$site_title."\n"; ?>
die('file not found');
}
if (isset($_SESSION['username']) && isset($_SESSION['password']))
{ switch($_SESSION['access'])
{ case "adm": $accLevel = 1; break;
case "pch": $accLevel = 1; break;
case "fly": $accLevel = 1; break;
default: $accLevel = 0;
}
}
else $accLevel = 0;
if ($accLevel == 0)
{ header("Cache-Control: public");
header("Content-Description: File Transfer");
header("Content-Disposition: attachment; filename=".$fileN);
header("Content-Type: application/force-download");
header("Content-Transfer-Encoding: binary");
$path = "cartas/";
$dlsPage = array('CardsFly1.xsl','CardsXML.zip','CardsPDF.zip','FlyXML.zip','FlyPDF.zip','PSXML.zip','PSPDF.zip','cdd.dtd','CDD.xml','dalf.dtd','Manual_CARDS-FLY.pdf');
foreach($dlsPage as $dls) { if ($dls == $fileN) $path = "files/"; }
readfile($path.$fileN);
}
if ($accLevel == 1)
{ if (preg_match("/^(cards|fly|ps)[0-9]{4}\.(xml|pdf)$/i",$fileN))
{ $carta = str_replace("pdf","xml",$fileN);
$rstDP = mysql_query("SELECT * FROM restricted_cards WHERE cardname = '".$carta."' LIMIT 1",$db) or die(mysql_error());
if (mysql_num_rows($rstDP) == 0) // normal
{ header("Cache-Control: public");
header("Content-Description: File Transfer");
header("Content-Disposition: attachment; filename=".$fileN);
header("Content-Type: application/force-download");
header("Content-Transfer-Encoding: binary");
$path = "cartas/";
readfile($path.$fileN);
}
else // DP
{ $rowDP = mysql_fetch_assoc($rstDP);
$cartaEnc = md5($fileN.$rowDP['date']);
header("Cache-Control: no-cache");
header("Content-Description: File Transfer");
header("Content-Disposition: attachment; filename=".$fileN);
header("Content-Type: application/force-download");
header("Content-Transfer-Encoding: binary");
$path = "cartas/DP/";
readfile($path.$cartaEnc);
}
}
else
{ $restricted = false;
$restrictedFiles = array('FlyXML.zip','FlyPDF.zip');
foreach($restrictedFiles as $rFile) { if ($rFile == $fileN) $restricted = true; }
if ($restricted)
{ if ($fileN == "FlyXML.zip") $rDoc = "fml";
if ($fileN == "FlyPDF.zip") $rDoc = "fdf";
$rstDocs = mysql_query("SELECT * FROM docs WHERE doc = '".$rDoc."' LIMIT 1",$db) or die(mysql_error());
$rowDocs = mysql_fetch_assoc($rstDocs);
$cartaEnc = md5($fileN.$rowDocs['date']);
header("Cache-Control: no-cache");
}
else
{ $cartaEnc = $fileN;
header("Cache-Control: public");
}
header("Content-Description: File Transfer");
header("Content-Disposition: attachment; filename=".$fileN);
header("Content-Type: application/force-download");
header("Content-Transfer-Encoding: binary");
$path = "files/";
readfile($path.$cartaEnc);
}
}
?>