47 lines
1.8 KiB
PHP
47 lines
1.8 KiB
PHP
<?php
|
|
// /var/www/html/db_download.php
|
|
require_once __DIR__ . '/db_init.php';
|
|
|
|
$tokenRec = require_valid_token();
|
|
|
|
$dbPath = QDB_PATH;
|
|
if (!file_exists($dbPath)) { http_response_code(404); echo "Database not found"; exit; }
|
|
$enc = file_get_contents($dbPath);
|
|
if ($enc === false) { http_response_code(500); echo "Read error"; exit; }
|
|
|
|
try {
|
|
$plain = aes256_cbc_decrypt_bytes($enc, get_master_key_bytes());
|
|
} catch (Throwable $e) {
|
|
http_response_code(500); echo "Decryption failed"; exit;
|
|
}
|
|
|
|
$role = $tokenRec['role'] ?? '';
|
|
if ($role !== 'admin') {
|
|
$tmpFilter = tempnam(sys_get_temp_dir(), 'qdb_filt_');
|
|
file_put_contents($tmpFilter, $plain);
|
|
try {
|
|
$fpdo = new PDO("sqlite:$tmpFilter");
|
|
$fpdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
|
|
$fpdo->exec("PRAGMA foreign_keys = OFF;");
|
|
[$clause, $params] = rbac_client_filter($tokenRec);
|
|
$delStmt = $fpdo->prepare("DELETE FROM client WHERE NOT ($clause)");
|
|
foreach ($params as $k => $v) $delStmt->bindValue($k, $v);
|
|
$delStmt->execute();
|
|
$fpdo->exec("DELETE FROM client_answer WHERE clientCode NOT IN (SELECT clientCode FROM client)");
|
|
$fpdo->exec("DELETE FROM completed_questionnaire WHERE clientCode NOT IN (SELECT clientCode FROM client)");
|
|
// Remove sensitive tables that non-admin users should never receive
|
|
foreach (['users', 'admin', 'supervisor', 'coach'] as $tbl) {
|
|
$fpdo->exec("DELETE FROM $tbl");
|
|
}
|
|
$fpdo = null;
|
|
$plain = file_get_contents($tmpFilter);
|
|
} finally {
|
|
@unlink($tmpFilter);
|
|
}
|
|
}
|
|
|
|
header('Content-Type: application/octet-stream');
|
|
header('Content-Disposition: attachment; filename="questionnaire.sqlite"');
|
|
header('Content-Length: ' . strlen($plain));
|
|
echo $plain;
|