<?php
//database connection information, which can be encrypted/decrypted or store it above the root and require_once the file
$dbhost = '127.0.0.1'; //one should know this info and enter the correct host
$dbname = 'xenforo'; //db name should be xenforo but look it up
$dbuser = 'root'; //store the user name for the db. my example using mariadb default root with no pass
$dbpass = '';
$dbatt = array(
PDO::ATTR_EMULATE_PREPARES => false,
PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC
);
if (!empty($SERVER['QUERY_STRING']) && is_string($SERVER['QUERY_STRING'])) {
if (preg_match("/^attachments+\/[A-Za-z0-9\-]+txt.+[0-9]+\/+$/", mb_strtolower($_SERVER['QUERY_STRING'])) === 1) {
$queryString = (array) explode('/', $_SERVER['QUERY_STRING']);
$queryString = (array) explode('.', $queryString[1]);
$filenumber = $queryString[1]; //we need the number from the end of the file as data_id
$queryString = (array) explode('-txt', $queryString[0]);
$file = $queryString[0] . '.txt';
//one needs to find the actual directory where attachment hashes are stored and replace the string below with this path
$filepath = 'data_path/attachments/possibly_another_dir/';
//replace xf_attachment_table with the table that holds the correct attachment info
$dbconn = new PDO("mysql:host=$dbhost; dbname=$dbname; charset=utf8mb4", $dbuser, $dbpass, $dbatt);
$dbquery = 'SELECT file_size, file_hash FROM xf_attachment_table WHERE data_id = :did';
$dpbsd = $dbconn->prepare($dbquery);
$dpbsd->execute(array(':did' => $filenumber));
$field = $dpbsd->fetch();
$dbfilesize = $field['file_size']; //probably named file_size and file_hash respectively
$dbhash = $field['file_hash'];
$datafile = $filenumber . '-' . $dbhash . '.data';
$actualfile = $filepath . $datafile;
$encodedfilename = rawurlencode($file);
header('Content-Type: text/plain; charset=UTF-8');
header('Content-Length: ' . $dbfilesize);
header("Content-Disposition: inline; filename*=UTF-8''" . $encodedfilename);
echo file_get_contents($actualfile);
exit; //we should be in the new tab or target window, so stop script execution
}
}
require_once('indexold.php'); //otherwise, load the original index now renamed indexold
