tuttogare/public_html/changelogs/media.php

<?php
$configPath = substr(__DIR__,0,strpos(__DIR__,"/public_html"))."/config.php";
include_once($configPath);
if (empty($_GET["open"])) {
    http_response_code(403);
    die();
}
if (strpos($_GET["open"],"..") !== false) {
    http_response_code(403);
    die();
}

preg_match_all(
    '/\/(main|tenant)\/\d+.+\/assets\/([a-zA-Z0-9_]+)[.](jpeg|jpg|png|pdf|webp|pdf|mp4)$/m',
    $_GET["open"],
    $matches
);
if (empty($matches)) {
    http_response_code(403);
    die();
}

$file_path = $config["changelogs"]["changelogs_path"] . $_GET["open"];
if (!file_exists($file_path)) {
    http_response_code(403);
    die();
}

const CHUNK_SIZE = 1048576;
$fd = fopen($file_path, 'rb');
ob_clean();
header('Content-Type:' . filetype($file_path)); 
while(!feof($fd)) { 
    echo fread($fd,CHUNK_SIZE); 
    ob_flush(); 
}
fclose($fd);