<?php
session_start();
require_once('../config.php');

// ✅ Only logged-in users
if (!isset($_SESSION['user_id'])) {
    die("Access denied");
}

// Get file name from URL
if (!isset($_GET['file'])) {
    die("File not specified");
}

$file = basename($_GET['file']); // security (prevents hacking)

// Upload path
$filePath = "../uploads/" . $file;

// Check if file exists
if (!file_exists($filePath)) {
    die("File not found on server");
}

// Force download headers
header('Content-Description: File Transfer');
header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename="' . basename($filePath) . '"');
header('Content-Length: ' . filesize($filePath));

readfile($filePath);
exit;
?>