??????????????
??????????????
<?php
include('session-st.php');  // Student session check
include 'connection.php';

if (isset($_GET['file'])) {
    $file_path = urldecode($_GET['file']);
    $student_course = $_SESSION['course'];
    
    // Validate access: Same as view.php
    $sql = "SELECT tf.file_path FROM tasks t JOIN task_files tf ON t.id = tf.task_id WHERE tf.file_path = ? AND t.course = ? AND t.status IN ('active', 'published')";
    $stmt = $conn->prepare($sql);
    $stmt->bind_param("ss", $file_path, $student_course);
    $stmt->execute();
    if ($stmt->get_result()->num_rows > 0 && file_exists($file_path)) {
        $file_ext = strtolower(pathinfo($file_path, PATHINFO_EXTENSION));
        $mime_types = [
            'pdf' => 'application/pdf',
            'doc' => 'application/msword',
            'docx' => 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
            'jpg' => 'image/jpeg',
            'png' => 'image/png'
        ];
        if (isset($mime_types[$file_ext])) {
            header('Content-Type: ' . $mime_types[$file_ext]);
            header('Content-Disposition: attachment; filename="' . basename($file_path) . '"');
            header('Content-Length: ' . filesize($file_path));
            readfile($file_path);
            exit;
        }
    }
}
echo "Access denied or file not found.";
?>