<?php
require_once __DIR__ . '/common.php';
$f = $_GET['f'] ?? '';
if (empty($f) || preg_match('/[^a-zA-Z0-9._-]/', $f)) {
    http_response_code(404);
    exit;
}
$path = $UPLOADS_DIR . '/' . $f;
if (!file_exists($path) || !is_file($path)) {
    http_response_code(404);
    exit;
}
$pathInfo = pathinfo($path);
$stem = $pathInfo['filename'];
$ext = isset($pathInfo['extension']) ? '.' . $pathInfo['extension'] : '';
$unique = bin2hex(random_bytes(4));
$downloadName = $stem . '_' . $unique . $ext;
header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename="' . $downloadName . '"');
header('Content-Length: ' . filesize($path));
readfile($path);