<?php
session_start(); // Start Session
require("configure.php"); 
$id	= htmlspecialchars($_GET["id"],ENT_QUOTES);
if(isSet($_SESSION['loginname']) && !empty($_GET["id"])) {
	$id_check_sql = "SELECT * FROM file_content WHERE hash=:hash";
	$id_check = Db::getDbh()->prepare($id_check_sql);
	$id_check->execute(array(":hash" => $id));
	if( $error = $id_check->getError(array(":hash" => $id)) ){
		var_dump($error);
	}
	$id_check_count = $id_check->rowCount();
	if ($id_check_count>0){
		$row_id_check = $id_check->fetch(PDO::FETCH_ASSOC);
		
		$user_role_sql = "SELECT * FROM file_role_user WHERE userid=:userid";
		$user_role = Db::getDbh()->prepare($user_role_sql);
		$user_role->execute(array(":userid" => $_SESSION['loginid']));
		if( $error = $user_role->getError(array(":userid" => $_SESSION['loginid'])) ){
			var_dump($error);
		}
		$row_user_role = $user_role->fetch(PDO::FETCH_ASSOC);
		
		$permission_check_sql = "SELECT * FROM file_folder_permission WHERE folderid=:folderid AND roleid=:roleid AND p_read = '1'";
		$permission_check = Db::getDbh()->prepare($permission_check_sql);
		$permission_check->execute(array(":folderid" => $row_id_check{'folderid'}, ":roleid" => $row_user_role{'roleid'}));
		if( $error = $permission_check->getError(array(":folderid" => $row_id_check{'folderid'}, ":roleid" => $row_user_role{'roleid'})) ){
			var_dump($error);
		}
		$permission_check_count = $permission_check->rowCount();

		$company_check_sql = "SELECT * FROM file_company_user WHERE userid=:userid AND companyid=:companyid";
		$company_check = Db::getDbh()->prepare($company_check_sql);
		$company_check->execute(array(":userid" => $_SESSION['loginid'], ":companyid" => $row_id_check{'companyid'}));
		if( $error = $company_check->getError(array(":userid" => $_SESSION['loginid'], ":companyid" => $row_id_check{'companyid'})) ){
			var_dump($error);
		}
		$company_check_count = $company_check->rowCount();
		if ($permission_check_count > 0 && $company_check_count > 0 || $_SESSION['role'] == 'Superadmin' || $_SESSION['role'] == 'Admin'){
			require("mime_type_lib.php");
			$mime = get_file_mime_type("file/".$row_id_check{'filename'});
			header("Content-type: ".$mime);
			header("Content-Disposition: attachment; filename=".$row_id_check{'title'}.".".$row_id_check{'extension'});
			echo file_get_contents("file/".$row_id_check{'filename'});
			//readfile($file); // if it's php include it. you may need to extend this code
		}	else	{
			echo "You Do Not Have Permission To Download.";
			exit;
		}
	}	else	{
		echo "File Not Found!";
		exit;
	}
	$dbh = null;
}	else	{
   // bad auth error
	header("Location: index.php");
}
?>