<?php
session_start();
require_once( __DIR__ . '/../include/session_helpers.php' );
require_once( __DIR__ . '/../my.php' );

if ( !isset( $_SESSION['operatorloggedin'] ) ) {
  header( 'Location: login.php' );
  exit;
}
if ( isset( $_SESSION['expires_at'] ) && time() > $_SESSION['expires_at'] ) {
  itsm_destroy_session();
  header( 'Location: login.php?expired=1' );
  exit;
}
if ( !isset( $_GET['id'] ) || !is_numeric( $_GET['id'] ) ) {
  http_response_code( 400 );
  exit( 'Invalid attachment' );
}

$attachment_id = (int)$_GET['id'];
$stmt = mysqli_prepare( $con, "SELECT filename, mimetype, filesize, content FROM itsm_core_attachments WHERE id = ?" );
mysqli_stmt_bind_param( $stmt, 'i', $attachment_id );
mysqli_stmt_execute( $stmt );
mysqli_stmt_bind_result( $stmt, $filename, $mimetype, $filesize, $content );
$found = mysqli_stmt_fetch( $stmt );
mysqli_stmt_close( $stmt );

if ( !$found ) {
  http_response_code( 404 );
  exit( 'Attachment not found' );
}

$safe_filename = basename( (string)$filename );
$is_inline_image = isset( $_GET['inline'] ) && strpos( (string)$mimetype, 'image/' ) === 0;
header( 'Content-Type: ' . ( $mimetype ?: 'application/octet-stream' ) );
header( 'Content-Length: ' . (int)$filesize );
header( 'Content-Disposition: ' . ( $is_inline_image ? 'inline' : 'attachment' ) . '; filename="' . str_replace( '"', '', $safe_filename ) . '"' );
header( 'X-Content-Type-Options: nosniff' );
echo $content;
exit;
