<?php
session_start();

error_reporting(E_ALL);
ini_set('display_errors', 1);

if (!isset($_SESSION['phone'])) {
    die("Unauthorized Access");
}

/* ================= GET FILE ================= */
$file = $_GET['file'] ?? '';

if (empty($file)) {
    die("File parameter missing");
}

/* ================= SECURITY CHECK ================= */
/* Prevent ../ path traversal */
$file = str_replace(['../', '..\\'], '', $file);

/* ================= FILE EXISTS ================= */
if (!file_exists($file)) {
    die("File not found");
}

/* ================= FILE INFO ================= */
$filename = basename($file);
$filesize = filesize($file);

/* ================= PDF HEADER ================= */
header('Content-Type: application/pdf');
header('Content-Disposition: inline; filename="' . $filename . '"');
header('Content-Length: ' . $filesize);
header('Cache-Control: private');
header('Pragma: public');

/* ================= CLEAR BUFFER ================= */
ob_clean();
flush();

/* ================= OUTPUT FILE ================= */
readfile($file);

exit;
?>