<?php
session_start();

if (!isset($_SESSION['phone'])) {
    die("Unauthorized");
}

if (!isset($_GET['file'])) {
    die("Invalid request");
}

$file = $_GET['file'];

/* ===== SECURITY CHECK ===== */
$file = str_replace(['..', './', '\\'], '', $file);

/* ===== ALLOW ONLY new/ll DIRECTORY ===== */
$baseDir = realpath(__DIR__ . '/new/ll');
$fullPath = realpath(__DIR__ . '/' . $file);

if (!$fullPath || strpos($fullPath, $baseDir) !== 0) {
    die("File not found");
}

if (!file_exists($fullPath)) {
    die("File not found");
}

/* ===== DOWNLOAD ===== */
header('Content-Type: application/pdf');
header('Content-Disposition: inline; filename="' . basename($fullPath) . '"');
header('Content-Length: ' . filesize($fullPath));
readfile($fullPath);
exit;
