<?php
session_start();

if(!isset($_SESSION['admin'])){
    die("Unauthorized");
}

$token = $_GET['token'] ?? '';
$file  = $_GET['file'] ?? '';

$token = basename($token);
$file  = basename($file);

$path = "../uploads/".$token."/".$file;

if(!file_exists($path)){
    die("File not found");
}

header('Content-Description: File Transfer');
header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename="'.basename($path).'"');
header('Content-Length: ' . filesize($path));

readfile($path);
exit;