<?php

/* -----------------------------------------------------------------
 * 	$Id: download_pdf_bill.php 622 2013-09-22 17:25:29Z akausch $
 * 	Copyright (c) 2011-2021 commerce:SEO by Webdesign Erfurt
 * 	http://www.commerce-seo.de
 * ------------------------------------------------------------------
 * 	based on:
 * 	(c) 2000-2001 The Exchange Project  (earlier name of osCommerce)
 * 	(c) 2002-2003 osCommerce - www.oscommerce.com
 * 	(c) 2003     nextcommerce - www.nextcommerce.org
 * 	(c) 2005     xt:Commerce - www.xt-commerce.com
 * 	Released under the GNU General Public License
 * --------------------------------------------------------------- */

include ('includes/application_top.php');
if (!isset($_SESSION['customer_id'])) {
    die;
}
if ((isset($_GET['order']) && !is_numeric($_GET['order']))) {
    die;
}
// Check that order_id, customer_id and filename match
$downloads_query = xtc_db_query("SELECT * 
								FROM " . TABLE_ORDERS . " o, " . TABLE_ORDERS_PDF . " op
								WHERE o.customers_id = '" . (int) $_SESSION['customer_id'] . "' 
								AND o.orders_id = '" . (int) $_GET['order'] . "' 
								AND o.orders_id = op.order_id 
								AND op.bill_name != ''");

if (!xtc_db_num_rows($downloads_query)) {
    die;
} else {
	$pdf = xtc_db_fetch_array($downloads_query);
}

if (!file_exists(DIR_FS_CATALOG . $downloads['bill_name'])) {
	die;
}

$pdf_pfad = 'admin/'.$pdf['bill_name'];
$pdf_name = substr($pdf['bill_name'], 15, strlen($pdf['bill_name']));

if (file_exists($pdf_pfad)) {
    $fp = fopen($pdf_pfad, 'rb');
    $pdf = fread($fp, filesize($pdf_pfad));
    fclose($fp);

    header("Last-Modified: " . gmdate("D,d M Y H:i:s") . " GMT");
    header("Cache-Control: no-cache, must-revalidate");
    header("Pragma: no-cache");
    header("Content-type: application/octet-stream");
    header("Content-Disposition: attachment; filename=\"" . $pdf_name . "\"");
    header("Content-type: application/pdf");

    echo $pdf;
} else {
    echo 'Die PDF-Rechnung konnte nicht gefunden werden!';
}