<?php  defined('C5_EXECUTE') or die("Access Denied.");
 
 
class FileAccessController extends Controller {
 
    var $restricted_sets = array('Restricted');
 
    function view($arg1=false, $arg2=false, $arg3=false, $arg4=false, $arg5=false, $arg6=false, $arg7=false, $arg8=false, $arg9=false, $arg10=false) {
        $uri = false;
        for ($i=0; $i<=10; $i++) {
            if (!empty(${'arg'.$i})) $uri .= '/'.${'arg'.$i};
        }
        if (!empty($uri)) $uri = 'files'.$uri;
 
        $basedir = realpath(dirname(__FILE__).'/../');
 
        if (!file_exists($basedir.'/'.$uri)) {
            echo 'File does not exist';
            exit;
        }
 
        $db = Loader::db();
        //we don't have the fid, so get fid from DB by filename and size in bytes
        $rows = $db->GetAll("SELECT * FROM `FileVersions` WHERE fvFilename=? AND fvSize=? ORDER BY fvID DESC", array(basename($uri), filesize($basedir.'/'.$uri)));
        //loop through all possible matches
        foreach ($rows as $row) {
            $f = File::getByID($row['fID']);
            if ($basedir.'/'.$uri == $f->getPath()) { //check if we have the right file
                $sets = $f->getFileSets();
                foreach ($sets as $s) {
                    $set_name = $s->getFileSetName();
                    if (in_array($set_name, $this->restricted_sets) && !self::isAdministrator()) { //check if file is in a restricted set and user is not an admin
                        continue(2);
                    }
                }
                //file found, not in restricted set so serve to browser
                if (self::getFileExtension($uri) == 'doc') {
                    header('content-type: application/msword');
                } elseif (self::getFileExtension($uri) == 'docx') {
                    header('content-type: application/vnd.openxmlformats-officedocument.wordprocessingml.document');
                } elseif (self::getFileExtension($uri) == 'pdf') {
                    header('content-type: application/pdf');
                } else {
                    header('content-type: application/octet-stream');
                }
                echo file_get_contents($basedir.'/'.$uri);
                exit;
            }
        }
        //file not found in DB or belongs to a restricted set
        echo 'Access to this file is restricted';
        exit;
 
   }
 
   static function getFileExtension($file) {
        return strtolower(pathinfo($file, PATHINFO_EXTENSION));
    }
 
    static function isAdministrator() {
        $u = new User(); //gets current user object
        if ($u->isLoggedIn()) {
            if ($u->isSuperUser()) return true;
            $g = Group::getByName("Administrators");
            if ($u->inGroup($g)) return true;
        }
        return false;
    }
}

 
<?php
namespace Application\Controller\SinglePage;
use PageController;
 
class FileAccess extends PageController {
 
    var $restricted_sets = array('Restricted');
 
    function view($arg1=false, $arg2=false, $arg3=false, $arg4=false, $arg5=false, $arg6=false, $arg7=false, $arg8=false, $arg9=false, $arg10=false) {
        $uri = false;
        for ($i=0; $i<=10; $i++) {
            if (!empty(${'arg'.$i})) $uri .= '/'.${'arg'.$i};
        }
        if (!empty($uri)) $uri = '/application/files'.$uri;
 
        $basedir = realpath(dirname(__FILE__).'/../../../');
 
        if (!file_exists($basedir.'/'.$uri)) {
            http_response_code(404);
         echo '<h1 class="error">File Not Found</h1>';
         echo '<p>No file could be found at this address. <a href="/">Back to Home</a>.</p>';
         die();
        }
 
        $db = \Database::connection();
        //we don't have the fid, so get fid from DB by filename and size in bytes
        $rows = $db->GetAll("SELECT * FROM `FileVersions` WHERE fvFilename=? AND fvSize=? ORDER BY fvID DESC", array(basename($uri), filesize($basedir.'/'.$uri)));
        //loop through all possible matches
        foreach ($rows as $row) {
            $f = \File::getByID($row['fID']);
            if ($uri == $f->getRelativePath()) { //check if we have the right file
                $sets = $f->getFileSets();
                foreach ($sets as $s) {
                    $set_name = $s->getFileSetName();
                    if (in_array($set_name, $this->restricted_sets) && !self::hasAccess($f)) { //check if file is in a restricted set and user does not have access
                        continue(2);
                    }
                }
                //file found, not in restricted set so serve to browser
                if (self::getFileExtension($uri) == 'doc') {
                    header('content-type: application/msword');
                } elseif (self::getFileExtension($uri) == 'docx') {
                    header('content-type: application/vnd.openxmlformats-officedocument.wordprocessingml.document');
                } elseif (self::getFileExtension($uri) == 'pdf') {
                    header('content-type: application/pdf');
                } else {
                    header('content-type: application/octet-stream');
                }
                echo file_get_contents($basedir.'/'.$uri);
                exit;
            }
        }
        //file not found in DB or belongs to a restricted set
      http_response_code(403);
      echo '<h1 class="error">Restricted Access</h1>';
        echo '<p>You must be logged in to access this resource. <a href="/">Back to Home</a>.</p>';
        die();
 
   }
 
   static function getFileExtension($file) {
        return strtolower(pathinfo($file, PATHINFO_EXTENSION));
    }
 
    static function hasAccess($f) {
        $u = new \User(); //gets current user object
        if ($u->isLoggedIn()) {
         if ($u->isSuperUser()) return true;
         $g = Group::getByName("Administrators");
         if ($u->inGroup($g)) return true;
         $fp = new \Permissions($f);   //gets file permissions relative to current user
         if ($fp->canViewFile()) return true;
        }
        return false;
    }
}