<?php
// Database connection and query (assuming $connection is set up correctly)
$result = $connection->query("SELECT * FROM curriculum ORDER BY uploaded_at DESC");

if (isset($_POST['download_curriculum'])) {
    $file_path = $_POST['file_path'] ?? '';

    // Validate file path to prevent directory traversal
    $base_dir = realpath($_SERVER['DOCUMENT_ROOT'] . '/uploads/curriculums/'); // Adjust path as needed
    $full_path = realpath($base_dir . '/' . basename($file_path));

    // Ensure the file is within the intended directory
    if ($full_path && strpos($full_path, $base_dir) === 0 && file_exists($full_path)) {
        // Clear output buffer to prevent any prior output
        ob_clean();
        flush();

        // Set headers for PDF download
        header('Content-Description: File Transfer');
        header('Content-Type: application/pdf');
        header('Content-Disposition: attachment; filename="' . basename($full_path) . '"');
        header('Content-Length: ' . filesize($full_path));
        header('Expires: 0');
        header('Cache-Control: must-revalidate');
        header('Pragma: public');

        // Read the file
        readfile($full_path);
        exit;
        header("Location: view_curriculum");
    } else {
        // File not found or invalid path
        $_SESSION['msg'] = "File not found or access denied.";
        $_SESSION['type'] = "error";
        header("Location: view_curriculum");
        exit;
    }
}
?>


<div class="card">
    <div class='row'>
        <div class='col-xs-12 col-sm-12 col-md-12'>
            <div class='panel panel-primary ch'>
                <div class='panel-heading'>
                    <h4 class='text-center'>VIEW ALL CURRICULUM</h4>
                </div>

                <div class='panel-body'>
                    <?php if ($result && $result->num_rows > 0): ?>
                        <div class="table-responsive">
                            <table class="table">
                                <thead class="bg-primary text-white">
                                    <tr>
                                        <th>Title</th>
                                        <th>Subject</th>
                                        <th>Class</th>
                                        <th>Term</th>
                                        <th>Session</th>
                                        <th>File</th>
                                        <th>Uploaded At</th>
                                    </tr>
                                </thead>
                                <tbody>
                                    <?php while ($row = $result->fetch_assoc()): ?>
                                        <tr>
                                            <td><?= htmlspecialchars($row['title']) ?></td>
                                            <td><?= htmlspecialchars($row['subject']) ?></td>
                                            <td><?= htmlspecialchars($row['class']) ?></td>
                                            <td><?= htmlspecialchars($row['term']) ?></td>
                                            <td><?= htmlspecialchars($row['session']) ?></td>
                                            <td>
                                                <form method="POST" style="display:inline;">
                                                    <input type="hidden" name="file_path" value="<?= htmlspecialchars($row['file_path']) ?>">
                                                    <button type="submit" name="download_curriculum" class="btn btn-xs btn-success">⬇ Download</button>
                                                </form>
                                            </td>
                                            <td><?= date("d-M-Y", strtotime($row['uploaded_at'])) ?></td>
                                        </tr>
                                    <?php endwhile; ?>
                                </tbody>
                            </table>
                        </div>
                    <?php else: ?>
                        <p class="text-danger text-center">No curriculum records found.</p>
                    <?php endif; ?>
                </div>
            </div>
        </div>
    </div>
</div>
