<?php
include_once("postget.php");
include_once("common.php");

$hotlinking = 'no';

if ($hotlinking == 'no') {
    // Only allow downloads when referrer contains this text
    define('ALLOWED_REFERRER', $serverurl . '/downloads.php');
} else {
    // Allow direct file download (hotlinking)?  Empty - allow hotlinking
    define('ALLOWED_REFERRER', '');
}


define('BASE_DIR', $config[40][1] . '/' . $config[75][1] . '/');
define('LOG_DOWNLOADS', false);
define('LOG_FILE', 'downloads.log');

$allowed_ext = array(
// archives
    'zip' => 'application/zip',
// documents
    'pdf' => 'application/pdf',
    'doc' => 'application/msword',
    'xls' => 'application/vnd.ms-excel',
    'ppt' => 'application/vnd.ms-powerpoint',
// executables
    'exe' => 'application/octet-stream',
// images
    'gif' => 'image/gif',
    'png' => 'image/png',
    'jpg' => 'image/jpeg',
    'jpeg' => 'image/jpeg',
// audio
    'mp3' => 'audio/mpeg',
    'wav' => 'audio/x-wav',
// video
    'mpeg' => 'video/mpeg',
    'mpg' => 'video/mpeg',
    'mpe' => 'video/mpeg',
    'mov' => 'video/quicktime',
    'avi' => 'video/x-msvideo'
);

if (ALLOWED_REFERRER !== ''
        && (!isset($_SERVER['HTTP_REFERER']) || strpos(strtoupper($_SERVER['HTTP_REFERER']), strtoupper(ALLOWED_REFERRER)) === false)
) {
    messagetop(_ERROR, 'hotlinking not allowed', 'downloads.php', 0);
}

set_time_limit(0);

if (!isset($_GET['f']) || empty($_GET['f'])) {
    messagetop(_ERROR, 'Please specify file name for download', 'downloads.php', 0);
}

$fname = basename($_GET['f']);

function find_file($dirname, $fname, &$file_path) {
    $dir = opendir($dirname);
    while ($file = readdir($dir)) {
        if (empty($file_path) && $file != '.' && $file != '..') {
            if (is_dir($dirname . '/' . $file)) {
                find_file($dirname . '/' . $file, $fname, $file_path);
            } else {
                if (file_exists($dirname . '/' . $fname)) {
                    $file_path = $dirname . '/' . $fname;
                    return;
                }
            }
        }
    }
}

$file_path = '';
find_file(BASE_DIR, $fname, $file_path);

if (!is_file($file_path)) {
    messagetop(_ERROR, 'File does not exist. Make sure you specified correct file name', 'downloads.php', 0);
}

$fsize = filesize($file_path);
$fext = strtolower(substr(strrchr($fname, "."), 1));

if ($allowed_ext[$fext] == '') {
    $mtype = '';
    if (function_exists('mime_content_type')) {
        $mtype = mime_content_type($file_path);
    } elseif (function_exists('finfo_file')) {
        $finfo = finfo_open(FILEINFO_MIME); // return mime type
        $mtype = finfo_file($finfo, $file_path);
        finfo_close($finfo);
    }
    if ($mtype == '') {
        $mtype = "application/force-download";
    }
} else {
    $mtype = $allowed_ext[$fext];
}

if (!isset($_GET['fc']) || empty($_GET['fc'])) {
    $asfname = $fname;
} else {
    $asfname = str_replace(array('"', "'", '\\', '/'), '', $_GET['fc']);
    if ($asfname === '')
        $asfname = 'NoName';
}

header("Pragma: public");
header("Expires: 0");
header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
header("Cache-Control: public");
header("Content-Description: File Transfer");
header("Content-Type: $mtype");
header("Content-Disposition: attachment; filename=\"$asfname\"");
header("Content-Transfer-Encoding: binary");
header("Content-Length: " . $fsize);

$file = @fopen($file_path, "rb");
if ($file) {
    while (!feof($file)) {
        print(fread($file, 1024 * 8));
        flush();
        if (connection_status() != 0) {
            @fclose($file);
            die();
        }
    }
    @fclose($file);
}
query("UPDATE hd_downloads SET downloads = downloads+1 WHERE file='" . $fname . "'", 0);
?>