| @@ -1,11 +1,10 @@ | ||
| 1 | 1 | <?php |
| 2 | 2 | |
| 3 | -$path = '../tmp/'; | |
| 4 | 3 | |
| 5 | 4 | $tempfilename = $_REQUEST['filename'].'.pdf'; |
| 6 | -if (strstr($tempfilename,'/') || strstr($tempfilename,'\\')) { die("Filename should not contain \ or / "); } | |
| 7 | 5 | $opname = $_REQUEST['opname']; |
| 6 | +$path = urldecode($_REQUEST['path']); | |
| 8 | 7 | $dest = $_REQUEST['dest']; |
| 9 | 8 | if ($tempfilename && file_exists($path.$tempfilename)) { |
| 10 | 9 | // mPDF 5.3.17 |
| 11 | 10 | if ($dest=='I') { |
| @@ -38,9 +37,9 @@ | ||
| 38 | 37 | if (!isset($_SERVER['HTTP_ACCEPT_ENCODING']) OR empty($_SERVER['HTTP_ACCEPT_ENCODING'])) { |
| 39 | 38 | // don't use length if server using compression |
| 40 | 39 | header('Content-Length: '.$filesize); |
| 41 | 40 | } |
| 42 | - $fd=fopen($path.$tempfilename,'rb'); | |
| 41 | + $fd=fopen($path.$tempfilename,'rb'); // mPDF 5.3.85 | |
| 43 | 42 | fpassthru($fd); |
| 44 | 43 | fclose($fd); |
| 45 | 44 | unlink($path.$tempfilename); |
| 46 | 45 | // ====================== DELETE OLD FILES - Housekeeping ========================================= |