<?php
if ( !defined('IN_MFA') )
	die("Hacking attempt");
	
$user->DieNotValid();
if(!$user->has_right("view"))
 	message_die("No Access",$lang['norights']);

// Check filename 
$filename = $user->user_root_dir.$_GET['filename'];
$validated = validateObject($filename);
if(gettype($validated) != "boolean")
	message_die("Invalid Object",$validated);
else
{   
		 // Create download file name to be displayed to user 
    $saveasname = basename(ROOT_DIR."/".$filename ); 
    header('Content-Type: application/octet-stream'); 
    header('Content-Length: '.filesize(ROOT_DIR."/".$filename )); 
    header('Content-Disposition: attachment; filename="'.$saveasname.'"'); 
    // Output file 
    readfile(ROOT_DIR."/".$filename);
    exit;
}
?>