<?php
include_once "{$_SERVER['DOCUMENT_ROOT']}/common.inc.php";
/*
$fobj = new Attach(TB_attach_list);

if( $_REQUEST['file_id'] ){
  //보안에 취약. 변수 하나로 모든 첨부파일에 접근시도 할 수 있으므로 사용자제. 꼭 필요할 경우 referer 체크를 적용하고 사용.
  return;
  $frow = $fobj->getAttachId($_REQUEST['file_id']);
  $_REQUEST['gubun'] = $frow['gubun'];
  $_REQUEST['nid'] = $frow['nid'];
  $_REQUEST['sid'] = $frow['sid'];
}else{
  $frow = $fobj->getAttach($_REQUEST['gubun'], $_REQUEST['nid'], $_REQUEST['sid']);
}
*/

switch( $_REQUEST['gubun'] ){
  case "board":
    $kbrd_obj = new Board($_REQUEST['board_id']);
    $where = new DB_where("and");
    $where->add("board_id = ?", $kbrd_obj->board_info['board_id']);
    $where->add("cid = ?", $_REQUEST['cid']);
    $where->add("aid = ?", $_REQUEST['aid']);

    $wqry = $where->get_where();
    $whereqry = $wqry['qry'];
    $whererow = $wqry['val'];

    $sql = "select * from ".TB_board_attach." where {$whereqry}";
    $row = $kbrd_obj->DB->queryFirstRow($sql, $whererow);
    if( $row['board_id'] && $kbrd_obj->chkUseOnly("read") ){ //게시물이 존재하고 읽기 권한이 있으면
      $filename = $row['file_name'];
      $filepath = _UP_PATH_."/{$_REQUEST['gubun']}/{$kbrd_obj->board_info['board_id']}/{$_REQUEST['cid']}_{$_REQUEST['aid']}_".strrev(md5("{$_REQUEST['cid']}_{$_REQUEST['aid']}")).".data";
    }
  break;

  case "temp":
    $filename = $_REQUEST['name'];
    $filepath = _UP_PATH_."/temp/".$_REQUEST['tmp_name'];
    $filesize = $_REQUEST['size'];
  break;

  case "att":
  case "draw":
  case "rdraw":
  case "ncr":
    $filename = $_REQUEST['name'];
    $filepath = _UP_PATH_."/{$_REQUEST['gubun']}/{$_REQUEST['nid']}_{$_REQUEST['sid']}_{$_REQUEST['file_id']}.dat";
    $filesize = $_REQUEST['size'];
  break;

  default:
    $fobj = new Attach(TB_attach_list);
    $frow = $fobj->getAttach($_REQUEST['gubun'], $_REQUEST['nid'], $_REQUEST['sid']);
    $filename = $frow['file_name'];
    $filepath = _UP_PATH_."/{$frow['gubun']}/{$frow['nid']}_{$frow['sid']}.dat";

    //여기는 로그인 안되면 못보니까.
    if( !$GLOBALS['_Umem'] ){
      //echo "Login Needed!";
      //exit;
    }
}

if( !file_exists($filepath) ){
  echo $filepath;
  echo "Not exist";
  exit;
}

if( strpos($frow['file_type'], "image") !== false ){
  if( $_REQUEST['thumb'] ){
    $thumb_width = $_REQUEST['width']?:200;
    $thumb_height = $_REQUEST['height']?:200;

    $thumbpath = "{$filepath}_{$_REQUEST['thumb']}_{$thumb_width}x{$thumb_height}";
    if( !file_exists($thumbpath) ){
      file_remove("{$filepath}_{$_REQUEST['thumb']}_*");
      image_thumb( $filepath, $thumbpath, $thumb_width, $thumb_height );
    }

    $filepath = $thumbpath;
  }
}

//$filename = iconv("UTF-8", "CP949", $filename);
if( !$row['file_type'] ){
  $extension = explode(".", $filename);
  $mimetype = \Frody\Util\MultiFileUpload::mime_type($extension[count($extension) - 1]);
}else{
  $mimetype = $row['file_type'];
}
$filename = get_encode_base64_str($filename);

Header('Pragma:public');
Header('Content-type: '.$mimetype);
Header('Content-Disposition: attachment; filename="'.$filename.'"');
Header("Content-Description: PHP3 Generated Data");
Header("Cache-Control: cache, must-revalidate");
if( $filesize ){
  header('Content-Length: ' . $filesize);
}

$fs = fopen($filepath,"r");
fpassthru($fs);
@fclose($fs);