First version, for githup; UNSTABLE, DO NOT USE!

www/intern/wk-leitung/rechnungen_viewer.php

@@ -0,0 +1,46 @@
+<?php
+header('Content-Type: application/json');
+
+if (session_status() !== PHP_SESSION_ACTIVE) session_start();
+
+if (empty($_SESSION['access_granted_wk_leitung']) || $_SESSION['access_granted_wk_leitung'] !== true || empty($_SESSION['passcodewk_leitung_id']) || intval($_SESSION['passcodewk_leitung_id']) < 0 ) {
+    http_response_code(403);
+    exit;
+}
+
+if (!isset($_GET['order_id']) || intval($_GET['order_id']) < 1) {
+    echo json_encode(['success' => false, 'message' => 'Keine Id angegeben']);
+    http_response_code(422);
+    exit; 
+}
+
+if (!isset($baseDir)) {
+	$baseDir = $_SERVER['DOCUMENT_ROOT'];
+}
+
+$id = intval($_GET['order_id']);
+
+$filename = basename($id . '.pdf');
+
+$filePath = $baseDir . '/../private-files/rechnungen/' . $filename;
+
+if (!file_exists($filePath)) {
+    http_response_code(404);
+    exit('File not found');
+}
+
+// 5. Send headers
+header('Content-Description: File Transfer');
+header('Content-Type: application/pdf'); // adjust if needed
+header('Content-Disposition: inline; filename="' . $filename . '"');
+header('Content-Length: ' . filesize($filePath));
+header('Cache-Control: no-cache, must-revalidate');
+header('Pragma: public');
+
+// 6. Clean output buffer
+ob_clean();
+flush();
+
+// 7. Stream file
+readfile($filePath);
+exit;