<?php

require 'header.php';

require_login();

if ( isset($_REQUEST['comic']) ) {
   $comicfull = realpath(COMICSDIR . base64_decode(urldecode($_REQUEST['comic'])));
   if ( $comicfull === false ) exit();
   if ( substr($comicfull, 0, strlen(COMICSDIR)) != COMICSDIR ) exit();
} else {
   exit();
}

header("Pragma: public");
header("Content-Type: application/octet-stream");
header("Content-Disposition: attachment; filename=\"" . trim(basename($comicfull)) . "\"");
header("Content-Description: " . trim(basename($comicfull)));
header("Expires: 0");
header("Cache-Control: must-revalidate");
header("Content-length: " . filesize($comicfull));
readfile($comicfull);

exit();