<?php
require_once 'config.php';

// Cek token
if (!isset($_GET['token']) || $_GET['token'] !== BACKUP_TOKEN) {
    http_response_code(403);
    exit('Akses ditolak');
}

if (!isset($_GET['file'])) {
    http_response_code(400);
    exit('File tidak ditemukan');
}

$file = str_replace(['..', '\\'], '', $_GET['file']);
$path = UPLOAD_PATH . '/' . $file;

if (!file_exists($path) || !is_file($path)) {
    http_response_code(404);
    exit('File tidak ada');
}

header('Content-Type: application/octet-stream');
header('Content-Length: ' . filesize($path));
header('Content-Disposition: attachment; filename="' . basename($path) . '"');

readfile($path);
exit;