<?php
if (!isset($_GET['file'])) {
    die("Invalid request");
}

$baseDir = realpath("new/new/");
$file = basename($_GET['file']);
$path = realpath($baseDir . "/" . $file);

if (!$path || strpos($path, $baseDir) !== 0 || !file_exists($path)) {
    die("File not found");
}

header("Content-Type: application/pdf");
header("Content-Disposition: inline; filename=\"" . basename($path) . "\"");
header("Content-Length: " . filesize($path));

readfile($path);
exit;
