parkerslingshotrentals/view-doc.php

<?php
require_once __DIR__ . '/db.php';

$token = preg_replace('/[^a-f0-9]/', '', $_GET['_t'] ?? '');
if (!verifyAdminToken($token)) {
    http_response_code(403);
    header('Content-Type: text/plain');
    exit('Unauthorized — please log in to the admin panel first.');
}

$ref  = strtoupper(preg_replace('/[^A-Z0-9\-]/', '', $_GET['ref'] ?? ''));
$type = in_array($_GET['type'] ?? '', ['license','insurance']) ? $_GET['type'] : '';
if (!$ref || !$type) {
    http_response_code(400);
    header('Content-Type: text/plain');
    exit('Missing parameters.');
}

$col  = $type === 'license' ? 'license_file' : 'insurance_file';
$stmt = db()->prepare("SELECT {$col} AS file_path FROM bookings WHERE booking_ref=?");
$stmt->execute([$ref]);
$row  = $stmt->fetch();

if (!$row || !$row['file_path']) {
    http_response_code(404);
    header('Content-Type: text/plain');
    exit('Document not found.');
}

$path = resolveUploadPath(__DIR__, $row['file_path']);
if (!$path) {
    http_response_code(404);
    header('Content-Type: text/plain');
    exit('File not found.');
}

$mime = detectAllowedMime($path);
if (!$mime) {
    http_response_code(403);
    header('Content-Type: text/plain');
    exit('Invalid file type.');
}

$fname = $type . '-' . $ref . '.' . ALLOWED_DOC_MIMES[$mime];
header('Content-Type: ' . $mime);
header('Content-Disposition: inline; filename="' . $fname . '"');
header('Content-Length: ' . filesize($path));
header('Cache-Control: private, max-age=3600');
readfile($path);
exit;