From 3662bdefc2936334276ff6db560500511c18b521 Mon Sep 17 00:00:00 2001
From: Terranom674 <thomas_dannenberg@web.de>
Date: Sat, 5 Sep 2026 16:16:15 +0200
Subject: [PATCH] Add admin-only QR upload preview endpoint

---
 customer-qr-admin-file.php | 65 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 65 insertions(+)
 create mode 100644 customer-qr-admin-file.php

diff --git a/customer-qr-admin-file.php b/customer-qr-admin-file.php
new file mode 100644
index 0000000..9adb3df
--- /dev/null
+++ b/customer-qr-admin-file.php
@@ -0,0 +1,65 @@
+<?php
+$piwigo_root = realpath(dirname(__DIR__, 2));
+if ($piwigo_root === false)
+{
+  http_response_code(500);
+  exit;
+}
+
+define('PHPWG_ROOT_PATH', rtrim($piwigo_root, DIRECTORY_SEPARATOR).DIRECTORY_SEPARATOR);
+include_once(PHPWG_ROOT_PATH.'include/common.inc.php');
+
+if (!defined('BRATONIEN_TOOLS_PATH'))
+{
+  http_response_code(404);
+  exit;
+}
+
+check_status(ACCESS_ADMINISTRATOR);
+require_once(BRATONIEN_TOOLS_PATH.'include/customer_qr_upload.inc.php');
+
+$id = isset($_GET['id']) ? (int)$_GET['id'] : 0;
+if ($id < 1)
+{
+  http_response_code(404);
+  exit;
+}
+
+$table = bratonien_tools_customer_qr_table();
+$result = pwg_query('SELECT id, upload_year, stored_name, mime_type FROM `'.$table.'` WHERE id='.$id.' LIMIT 1');
+$row = pwg_db_fetch_assoc($result);
+if (!$row)
+{
+  http_response_code(404);
+  exit;
+}
+
+$year = (int)$row['upload_year'];
+$stored_name = (string)$row['stored_name'];
+$mime = strtolower((string)$row['mime_type']);
+$allowed_mimes = array('image/png', 'image/jpeg', 'image/webp', 'image/gif');
+
+if (
+  $stored_name === ''
+  || basename($stored_name) !== $stored_name
+  || !in_array($mime, $allowed_mimes, true)
+)
+{
+  http_response_code(404);
+  exit;
+}
+
+$path = bratonien_tools_customer_qr_storage_root().DIRECTORY_SEPARATOR.$year.DIRECTORY_SEPARATOR.$stored_name;
+if (!is_file($path) || !is_readable($path))
+{
+  http_response_code(404);
+  exit;
+}
+
+header('Content-Type: '.$mime);
+header('Content-Length: '.filesize($path));
+header('Cache-Control: private, no-store, max-age=0');
+header('X-Content-Type-Options: nosniff');
+header('Content-Disposition: inline; filename="qr-'.$year.'-'.$id.'.'.pathinfo($stored_name, PATHINFO_EXTENSION).'"');
+readfile($path);
+exit;