tuttogare/public_html/backend/log-viewer/filesystem.php

<?php
$configPath = substr(__DIR__, 0, strpos(__DIR__, "/public_html")) . "/config.php";
include_once($configPath);
if (empty($_SESSION["utente"]) || $_SESSION["utente"]->ruolo != "SAD") {
  die_forbidden();
}
  $logFolder = rtrim(dirname($config["db_log"]), "/");

  $requestedPath = $_GET["path"] ?? "/";
  $browsingPath = null;


  // Preveniamo directory trasversal
  $realBase = realpath($logFolder);

  $browsingPath = $logFolder . "/" . ltrim($requestedPath, "/");
  $browsingPath = realpath($browsingPath);

  if ($browsingPath === false || strpos($browsingPath, $realBase) !== 0) {
    // Path non valido
    $requestedPath = "";
    $browsingPath = $logFolder;
  }
  $requestedPath = substr($browsingPath, strlen($logFolder));
  

  // Indexing
  if (is_dir($browsingPath)) {
    $iterator = new \FilesystemIterator($browsingPath);
    include_once "{$beRoot}/layout/top.php";
    ?>
<div class="container-fluid pt-5">
    <div class="row">
        <div class="col-12">
            <p class="d-block display-4">
                <?= Modulo::header($radice) ?>
            </p>
        </div>
    </div>
</div>
<?php if($browsingPath !== $logFolder) : ?>
  <?php
    $_path = rtrim($requestedPath, "/");
    $query = http_build_query(["path" => substr($_path, 0, strrpos($_path, "/"))]);
  ?>
  <a href="/backend/log-viewer/filesystem.php?<?= $query ?>"
      class="btn my-1 btn-block btn-info text-left">
      <div class="d-flex">
          <div class="mr-3 align-self-center">
              <i class="fa fa-folder fa-lg"></i>
          </div>
          <div>
              <span class="title">Cartella superiore</span>
          </div>
      </div>
  </a>
<?php endif; ?>
<?php foreach($iterator as $file) : ?>
  <?php
    $query = http_build_query(["path" => rtrim($requestedPath, "/") . "/" . $file->getBasename()]);
  ?>
  <a href="/backend/log-viewer/filesystem.php?<?= $query ?>"
      class="btn my-1 btn-block btn-info text-left">
      <div class="d-flex">
          <div class="mr-3 align-self-center">
              <i class="fa fa-<?= $file->isDir() ? "folder" : "file" ?> fa-lg"></i>
          </div>
          <div>
              <span class="title"><?= $file->getBasename() ?> </span>
          </div>
      </div>

  </a>
<?php endforeach; ?>


<?php
    include_once ($beRoot."/layout/bottom.php");
  } else {
    // Prendiamo il contenuto del file
    $file = file_get_contents($browsingPath);
    if ($file === false) {
      die_forbidden();
    }
    // Otteniamo il mime type
    $finfo = new finfo(FILEINFO_MIME);
    $mime = $finfo->buffer($file);

    $downloadName = basename($browsingPath);

    header('Content-Description: File Transfer');
    header("Content-Type: {$mime}");
    header("Content-Disposition: attachment; filename={$downloadName}");
    header('Content-Transfer-Encoding: binary');
    header('Expires: 0');
    header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
    header('Pragma: public');
    die($file);
  }