[orbis] Weekly backup 2026-07-07 — 318 files changed, 48597 insertions(+), 7 deletions(-)

sites/parkerslingshotrentals.com/public_html/admin/view-doc.php

@@ -0,0 +1,49 @@
+<?php
+require_once dirname(__DIR__) . '/db.php';
+
+$token = preg_replace('/[^a-f0-9]/', '', $_GET['_t'] ?? '');
+if (!verifyAdminToken($token)) {
+    http_response_code(403);
+    header('Content-Type: text/plain');
+    exit('Unauthorized — please log in to the admin panel first.');
+}
+
+$ref  = strtoupper(preg_replace('/[^A-Z0-9\-]/', '', $_GET['ref'] ?? ''));
+$type = in_array($_GET['type'] ?? '', ['license','insurance']) ? $_GET['type'] : '';
+if (!$ref || !$type) {
+    http_response_code(400);
+    header('Content-Type: text/plain');
+    exit('Missing parameters.');
+}
+
+$col  = $type === 'license' ? 'license_file' : 'insurance_file';
+$stmt = db()->prepare("SELECT {$col} AS file_path FROM bookings WHERE booking_ref=?");
+$stmt->execute([$ref]);
+$row  = $stmt->fetch();
+
+if (!$row || !$row['file_path']) {
+    http_response_code(404);
+    header('Content-Type: text/plain');
+    exit('No document on file.');
+}
+
+$path = resolveUploadPath(dirname(__DIR__), $row['file_path']);
+if (!$path) {
+    http_response_code(404);
+    header('Content-Type: text/plain');
+    exit('File not found.');
+}
+
+$mime = detectAllowedMime($path);
+if (!$mime) {
+    http_response_code(403);
+    header('Content-Type: text/plain');
+    exit('Invalid file type.');
+}
+
+$fname = $type . '-' . $ref . '.' . ALLOWED_DOC_MIMES[$mime];
+header('Content-Type: ' . $mime);
+header('Content-Disposition: inline; filename="' . $fname . '"');
+header('Content-Length: ' . filesize($path));
+header('Cache-Control: no-store, no-cache');
+readfile($path);