32 lines
934 B
PHP
32 lines
934 B
PHP
<?php
|
|
require_once __DIR__ . '/../includes/bootstrap.php';
|
|
$staff = require_admin();
|
|
|
|
$file = basename($_GET['file'] ?? '');
|
|
$backupDir = realpath(__DIR__ . '/../backups');
|
|
|
|
if (!$file || !$backupDir) {
|
|
http_response_code(400); die('Ungültige Anfrage.');
|
|
}
|
|
|
|
// Nur backup_*.zip erlauben
|
|
if (!preg_match('/^backup_[\d\-_]+\.(zip|tar\.gz)$/', $file)) {
|
|
http_response_code(403); die('Ungültiger Dateiname.');
|
|
}
|
|
|
|
$path = $backupDir . '/' . $file;
|
|
|
|
// Sicherheitscheck: Datei muss im backups/-Ordner liegen
|
|
if (!file_exists($path) || strpos(realpath($path), $backupDir) !== 0) {
|
|
http_response_code(404); die('Backup nicht gefunden.');
|
|
}
|
|
|
|
audit_log($staff['id'], "Backup heruntergeladen: $file");
|
|
|
|
header('Content-Type: application/zip');
|
|
header('Content-Disposition: attachment; filename="' . $file . '"');
|
|
header('Content-Length: ' . filesize($path));
|
|
header('Cache-Control: private, no-cache');
|
|
readfile($path);
|
|
exit;
|