90 lines
2.9 KiB
PHP
90 lines
2.9 KiB
PHP
<?php
|
|
include_once "{$_SERVER['DOCUMENT_ROOT']}/common.inc.php";
|
|
/*
|
|
$fobj = new Attach(TB_attach_list);
|
|
|
|
if( $_REQUEST['file_id'] ){
|
|
//보안에 취약. 변수 하나로 모든 첨부파일에 접근시도 할 수 있으므로 사용자제. 꼭 필요할 경우 referer 체크를 적용하고 사용.
|
|
return;
|
|
$frow = $fobj->getAttachId($_REQUEST['file_id']);
|
|
$_REQUEST['gubun'] = $frow['gubun'];
|
|
$_REQUEST['nid'] = $frow['nid'];
|
|
$_REQUEST['sid'] = $frow['sid'];
|
|
}else{
|
|
$frow = $fobj->getAttach($_REQUEST['gubun'], $_REQUEST['nid'], $_REQUEST['sid']);
|
|
}
|
|
*/
|
|
|
|
switch( $_REQUEST['gubun'] ){
|
|
case "board":
|
|
$kbrd_obj = new Board($_REQUEST['board_id']);
|
|
$where = new DB_where("and");
|
|
$where->add("board_id = ?", $kbrd_obj->board_info['board_id']);
|
|
$where->add("cid = ?", $_REQUEST['cid']);
|
|
$where->add("aid = ?", $_REQUEST['aid']);
|
|
|
|
$wqry = $where->get_where();
|
|
$whereqry = $wqry['qry'];
|
|
$whererow = $wqry['val'];
|
|
|
|
$sql = "select * from ".TB_board_attach." where {$whereqry}";
|
|
$row = $kbrd_obj->DB->queryFirstRow($sql, $whererow);
|
|
if( $row['board_id'] && $kbrd_obj->chkUseOnly("read") ){ //게시물이 존재하고 읽기 권한이 있으면
|
|
$filename = $row['file_name'];
|
|
$filepath = _UP_PATH_."/{$_REQUEST['gubun']}/{$kbrd_obj->board_info['board_id']}/{$_REQUEST['cid']}_{$_REQUEST['aid']}_".strrev(md5("{$_REQUEST['cid']}_{$_REQUEST['aid']}")).".data";
|
|
}
|
|
break;
|
|
|
|
default:
|
|
$fobj = new Attach(TB_attach_list);
|
|
$frow = $fobj->getAttach($_REQUEST['gubun'], $_REQUEST['nid'], $_REQUEST['sid']);
|
|
$filename = $frow['file_name'];
|
|
$filepath = _UP_PATH_."/{$frow['gubun']}/{$frow['nid']}_{$frow['sid']}.dat";
|
|
|
|
//여기는 로그인 안되면 못보니까.
|
|
if( !$GLOBALS['_Umem'] ){
|
|
echo "Login Needed!";
|
|
exit;
|
|
}
|
|
}
|
|
|
|
if( !file_exists($filepath) ){
|
|
echo $filepath;
|
|
echo "Not exist";
|
|
exit;
|
|
}
|
|
|
|
if( strpos($frow['file_type'], "image") !== false ){
|
|
if( $_REQUEST['thumb'] ){
|
|
$thumb_width = $_REQUEST['width']?:200;
|
|
$thumb_height = $_REQUEST['height']?:200;
|
|
|
|
$thumbpath = "{$filepath}_{$_REQUEST['thumb']}_{$thumb_width}x{$thumb_height}";
|
|
if( !file_exists($thumbpath) ){
|
|
file_remove("{$filepath}_{$_REQUEST['thumb']}_*");
|
|
image_thumb( $filepath, $thumbpath, $thumb_width, $thumb_height );
|
|
}
|
|
|
|
$filepath = $thumbpath;
|
|
}
|
|
}
|
|
|
|
//$filename = iconv("UTF-8", "CP949", $filename);
|
|
if( !$row['file_type'] ){
|
|
$extension = explode(".", $filename);
|
|
$mimetype = \Frody\Util\MultiFileUpload::mime_type($extension[count($extension) - 1]);
|
|
}else{
|
|
$mimetype = $row['file_type'];
|
|
}
|
|
|
|
$filename = get_encode_base64_str($filename);
|
|
|
|
Header('Pragma:public');
|
|
Header('Content-type: '.$mimetype);
|
|
Header('Content-Disposition: attachment; filename="'.$filename.'"');
|
|
Header("Content-Description: PHP3 Generated Data");
|
|
Header("Cache-Control: cache, must-revalidate");
|
|
|
|
$fs = fopen($filepath,"r");
|
|
fpassthru($fs);
|
|
@fclose($fs); |