HEX
Server: Apache
System: Linux clpupre 5.4.0-90-generic #101-Ubuntu SMP Fri Oct 15 20:00:55 UTC 2021 x86_64
User: undanet (1000)
PHP: 7.4.3
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
Upload Files
File: /home/undanet/www/PortalEmpleo/src/Utils/download.php
<?php

namespace PortalEmpleo\Utils;

use PortalEmpleo\Controller\UtilsController;

require __DIR__ . '/../../vendor/autoload.php';

    $_SERVER['HTTPS'] = $_SERVER['HTTPS'] == 'off' ? '' : $_SERVER['HTTPS'];
    $root = (!empty($_SERVER['HTTPS']) ? 'https' : 'http') . '://' . $_SERVER['HTTP_HOST'] . '/';
    
    if(isset($_GET["id"]) && isset($_GET["file"]) && isset($_GET["cvt"]))
	{
        //echo 'id:' . $_GET["id"] . ' ::: ' . 'file:' . $_GET["file"];
        $load = new Load();
        if($load->loadEnv() == null || !isset($_ENV))
        {
            throw $this->createNotFoundException(
                'No se han podido cargar las variables de entorno.'
            );
        }

        $actual_link = $_ENV['FILES_DIR'] . trim($_ENV['CANDIDATE_FILES_DIR'], '/') . '\\\\' . $_GET["id"] . '\\\\C' . $_GET["cvt"] . '\\\\' . basename($_GET['file']);
        $actual_link = trim($root, '/') . str_replace('\\\\', '/' ,$actual_link);
        //header("LOCATION:$actual_link");

        switch (pathinfo(basename($_GET['file']), PATHINFO_EXTENSION)) {
            case "pdf": $ctype="application/pdf"; break;
            //case "exe": $ctype="application/octet-stream"; break;
            case "zip": $ctype="application/zip"; break;
            case "docx":
            case "doc": $ctype="application/msword"; break;
            case "csv":
            case "xls":
            case "xlsx": $ctype="application/vnd.ms-excel"; break;
            case "ppt": $ctype="application/vnd.ms-powerpoint"; break;
            case "gif": $ctype="image/gif"; break;
            case "png": $ctype="image/png"; break;
            case "jpeg":
            case "jpg": $ctype="image/jpg"; break;
            case "tif":
            case "tiff": $ctype="image/tiff"; break;
            case "psd": $ctype="image/psd"; break;
            case "bmp": $ctype="image/bmp"; break;
            case "ico": $ctype="image/vnd.microsoft.icon"; break;
            default: $ctype="application/force-download";
          }


        $file_path = __DIR__ . '/../../..' . str_replace('\\\\', '/' ,$_ENV['FILES_DIR']) . $_ENV['CANDIDATE_FILES_DIR'] . $_GET["id"] . '/C' . $_GET["cvt"] . '/' . basename($_GET['file']);
        if(file_exists($file_path)) { 
            header("Pragma: public"); 
            header("Expires: 0");
            header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
            header("Cache-Control: private",false); 
            header("Content-Type: $ctype");
            header("Content-Disposition: inline; filename=\"".basename($file_path)."\";" );
            header("Content-Transfer-Encoding: binary");
            header("Content-Length: " . filesize($file_path));
            ob_clean();
  
            // Flush system output buffer 
            flush();  
            readfile($file_path); 
            die(); 
        } else { 
            //echo  $file_path;
            http_response_code(404); 
            die(); 
        }
    }
    elseif(isset($_GET["id"]) && isset($_GET["file"]))
	{
        //echo 'id:' . $_GET["id"] . ' ::: ' . 'file:' . $_GET["file"];
        $load = new Load();
        if($load->loadEnv() == null || !isset($_ENV))
        {
            throw $this->createNotFoundException(
                'No se han podido cargar las variables de entorno.'
            );
        }

        $actual_link = $_ENV['FILES_DIR'] . trim($_ENV['CANDIDATE_FILES_DIR'], '/') . '\\\\' . $_GET["id"] . '\\\\' . basename($_GET['file']);
        $actual_link = trim($root, '/') . str_replace('\\\\', '/' ,$actual_link);
        //header("LOCATION:$actual_link");

        switch (pathinfo(basename($_GET['file']), PATHINFO_EXTENSION)) {
            case "pdf": $ctype="application/pdf"; break;
            //case "exe": $ctype="application/octet-stream"; break;
            case "zip": $ctype="application/zip"; break;
            case "docx":
            case "doc": $ctype="application/msword"; break;
            case "csv":
            case "xls":
            case "xlsx": $ctype="application/vnd.ms-excel"; break;
            case "ppt": $ctype="application/vnd.ms-powerpoint"; break;
            case "gif": $ctype="image/gif"; break;
            case "png": $ctype="image/png"; break;
            case "jpeg":
            case "jpg": $ctype="image/jpg"; break;
            case "tif":
            case "tiff": $ctype="image/tiff"; break;
            case "psd": $ctype="image/psd"; break;
            case "bmp": $ctype="image/bmp"; break;
            case "ico": $ctype="image/vnd.microsoft.icon"; break;
            default: $ctype="application/force-download";
          }


        $file_path = __DIR__ . '/../../..' . str_replace('\\\\', '/' ,$_ENV['FILES_DIR']) . $_ENV['CANDIDATE_FILES_DIR'] . $_GET["id"] . '/' . basename($_GET['file']);
        if(file_exists($file_path)) { 
            header("Pragma: public"); 
            header("Expires: 0");
            header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
            header("Cache-Control: private",false); 
            header("Content-Type: $ctype");
            header("Content-Disposition: inline; filename=\"".basename($file_path)."\";" );
            header("Content-Transfer-Encoding: binary");
            header("Content-Length: " . filesize($file_path));
            ob_clean();
  
            // Flush system output buffer 
            flush();  
            readfile($file_path); 
            die(); 
        } else { 
            //echo  $file_path;
            http_response_code(404); 
            die(); 
        }
    }
    elseif (isset($_GET["ref"]) && isset($_GET["file"]))
	{
        $ref = clean($_GET["ref"]);
        //echo 'id:' . $_GET["ref"] . ' ::: ' . 'file:' . $_GET["file"];
        $load = new Load();
        if($load->loadEnv() == null || !isset($_ENV))
        {
            throw $this->createNotFoundException(
                'No se han podido cargar las variables de entorno.'
            );
        }
        
        switch (pathinfo(basename($_GET['file']), PATHINFO_EXTENSION)) {
            case "pdf": $ctype="application/pdf"; break;
            //case "exe": $ctype="application/octet-stream"; break;
            case "zip": $ctype="application/zip"; break;
            case "docx":
            case "doc": $ctype="application/msword"; break;
            case "csv":
            case "xls":
            case "xlsx": $ctype="application/vnd.ms-excel"; break;
            case "ppt": $ctype="application/vnd.ms-powerpoint"; break;
            case "gif": $ctype="image/gif"; break;
            case "png": $ctype="image/png"; break;
            case "jpeg":
            case "jpg": $ctype="image/jpg"; break;
            case "tif":
            case "tiff": $ctype="image/tiff"; break;
            case "psd": $ctype="image/psd"; break;
            case "bmp": $ctype="image/bmp"; break;
            case "ico": $ctype="image/vnd.microsoft.icon"; break;
            default: $ctype="application/force-download";
          }


        $file_path = __DIR__ . '/../../..' . str_replace('\\\\', '/' ,$_ENV['FILES_DIR']) . $_ENV['CALL_FILES_DIR'] . $ref . '/' . basename($_GET['file']);
        if(file_exists($file_path)) { 
            header("Pragma: public"); 
            header("Expires: 0");
            header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
            header("Cache-Control: private",false); 
            header("Content-Type: $ctype");
            header("Content-Disposition: inline; filename=\"".basename($file_path)."\";" );
            header("Content-Transfer-Encoding: binary");
            header("Content-Length: " . filesize($file_path));
            ob_clean();
  
            // Flush system output buffer 
            flush();  
            readfile($file_path); 
            die(); 
        } else { 
            //echo  $file_path;
            http_response_code(404); 
            die(); 
        }
    }
    elseif (isset($_GET["impugcvt"]) && isset($_GET["impugcdt"]) && isset($_GET["file"]))
	{
        $ref = clean($_GET["impugcvt"]) . '/' . clean($_GET["impugcdt"]) ;

        $load = new Load();
        if($load->loadEnv() == null || !isset($_ENV))
        {
            throw $this->createNotFoundException(
                'No se han podido cargar las variables de entorno.'
            );
        }
        
        switch (pathinfo(basename($_GET['file']), PATHINFO_EXTENSION)) {
            case "pdf": $ctype="application/pdf"; break;
            //case "exe": $ctype="application/octet-stream"; break;
            case "zip": $ctype="application/zip"; break;
            case "docx":
            case "doc": $ctype="application/msword"; break;
            case "csv":
            case "xls":
            case "xlsx": $ctype="application/vnd.ms-excel"; break;
            case "ppt": $ctype="application/vnd.ms-powerpoint"; break;
            case "gif": $ctype="image/gif"; break;
            case "png": $ctype="image/png"; break;
            case "jpeg":
            case "jpg": $ctype="image/jpg"; break;
            case "tif":
            case "tiff": $ctype="image/tiff"; break;
            case "psd": $ctype="image/psd"; break;
            case "bmp": $ctype="image/bmp"; break;
            case "ico": $ctype="image/vnd.microsoft.icon"; break;
            default: $ctype="application/force-download";
          }


        $file_path = __DIR__ . '/../../..' . str_replace('\\\\', '/' ,$_ENV['FILES_DIR']) . 'Impugnaciones/' . $ref . '/' . basename($_GET['file']);
        
        echo $file_path;
        if(file_exists($file_path)) { 
            header("Pragma: public"); 
            header("Expires: 0");
            header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
            header("Cache-Control: private",false); 
            header("Content-Type: $ctype");
            header("Content-Disposition: inline; filename=\"".basename($file_path)."\";" );
            header("Content-Transfer-Encoding: binary");
            header("Content-Length: " . filesize($file_path));
            ob_clean();
  
            // Flush system output buffer 
            flush();  
            readfile($file_path); 
            die(); 
        } else { 
            //echo  $file_path;
            http_response_code(404); 
            die(); 
        }
    }

    function clean($string) {

        $string = iconv('UTF-8', 'ASCII//TRANSLIT//IGNORE', $string);
    
        $string = str_replace(' ', '-', $string); // Replaces all spaces with hyphens.
        $string = preg_replace('/[^A-Za-z0-9\-\.]/', '', $string); // Removes special chars.
    
        return preg_replace('/-+/', '-', $string); // Replaces multiple hyphens with single one
    }
?>