diff --git a/guest_download_file.php b/guest_download_file.php
index cd366c37..34290d52 100644
--- a/guest_download_file.php
+++ b/guest_download_file.php
@@ -15,35 +15,42 @@ if (isset($_GET['id']) && isset($_GET['key'])) {
$sql = mysqli_query($mysqli, "SELECT * FROM shared_items WHERE item_id = $item_id AND item_key = '$item_key' AND item_expire_at > NOW() LIMIT 1");
$row = mysqli_fetch_array($sql);
- // Check result
- if (mysqli_num_rows($sql) !== 1 || !$row) {
- exit("No file.");
- }
-
- // Check it is a file
- if ($row['item_type'] !== "File") {
- exit("Bad item type.");
- }
-
- // Check item share is active & hasn't been viewed too many times
- if ($row['item_active'] !== "1" || $row['item_views'] >= $row['item_view_limit']) {
- exit("Item cannot be viewed at this time.");
- }
-
+ $item_active = intval($row['item_active']);
+ $item_type = sanitizeInput($row['item_type']);
+ $item_views = intval($row['item_views']);
+ $item_view_limit = intval($row['item_view_limit']);
$item_related_id = intval($row['item_related_id']);
$client_id = intval($row['item_client_id']);
- if (empty($row['item_views'])) {
- $item_views = 0;
- } else {
- $item_views = intval($row['item_views']);
+ // Check result
+ if (mysqli_num_rows($sql) !== 1 || !$row) {
+ exit("Item cannot be viewed at this time (disabled or invalid).");
+ }
+
+ // Check it is a file
+ if ($item_type !== "File") {
+ exit("Item cannot be viewed at this time (Bad item type: expected File but got $item_type).");
+ }
+
+ // Check item sharing link is active
+ if ($item_active != "1") {
+ exit("Item cannot be viewed at this time (disabled).");
+ }
+
+ // Check view limit (if not unlimited)
+ if ($item_view_limit !== 0) {
+ // Not unlimited
+ if ($item_views >= $item_view_limit) {
+ // Views exceed
+ exit("Item cannot be viewed at this time (view limit exceeded).");
+ }
}
$file_sql = mysqli_query($mysqli, "SELECT * FROM files WHERE file_id = $item_related_id AND file_client_id = $client_id LIMIT 1");
$file_row = mysqli_fetch_array($file_sql);
if (mysqli_num_rows($file_sql) !== 1 || !$file_row) {
- exit("No file.");
+ exit("Item cannot be viewed at this time (No file, may have been deleted).");
}
$file_name = sanitizeInput($file_row['file_name']);
@@ -51,11 +58,12 @@ if (isset($_GET['id']) && isset($_GET['key'])) {
$file_reference_name = sanitizeInput($file_row['file_reference_name']);
$client_id = intval($file_row['file_client_id']);
$file_path = "uploads/clients/$client_id/$file_reference_name";
+ $file_download_name = str_replace('.', '', $file_name) . '-' . $config_app_name . '-download.' . $file_ext; // Brand the downloaded file name, and also force the original file extension
// Display file as download
$mime_type = mime_content_type($file_path);
header('Content-type: '.$mime_type);
- header('Content-Disposition: attachment; filename=download.' . $file_ext);
+ header('Content-Disposition: attachment; filename=' . $file_download_name);
readfile($file_path);
// Update file view count
diff --git a/guest_view_item.php b/guest_view_item.php
index dcac8889..82e4150d 100644
--- a/guest_view_item.php
+++ b/guest_view_item.php
@@ -76,13 +76,13 @@ $item_expire = nullable_htmlentities($row['item_expire_at']);
$client_id = intval($row['item_client_id']);
?>
-
">
- $company_name";
- }
+ }
?>
Note: $item_note
"; } - echo "Download $file_name"; + echo "Download $file_name"; } elseif ($item_type == "Login") { @@ -243,4 +243,4 @@ if ($item_type == "Document") { \ No newline at end of file +?>