<?php

	$userAllowed = FALSE;
	$fileSuccess = FALSE;

	if (isset($_GET['content'])) {

		include('config.php');
		dbConn();

		$content = mysql_real_escape_string($_GET['content']);
		$content = str_replace("content/models/", "", $content);
		$file = '../../content/models/' . $content;

		if (is_file($file)) {

			if (preg_match('/\/tn\//', $file) || preg_match('/preview_thumbnail.jpg/', $file) || preg_match('/icon.jpg/', $file)) {
				// Ignore check if thumbnail, icon, or previewthumbnail
				$userAllowed = TRUE;
			} else {

				$contentSplit = explode("/", $content);

				if (isset($contentSplit[0]) && $contentSplit[0] != "" && isset($contentSplit[1]) && $contentSplit[1] != "") {
					$directory = $contentSplit[0] . "/" . $contentSplit[1];
				}

				if (isset($directory)) {

					$content_sql = mysql_query("SELECT * FROM `cms_content` WHERE `directory` = '" . $directory . "'") or die(mysql_error());

					if (mysql_num_rows($content_sql) == 1) {

						$content = mysql_fetch_object($content_sql);

					}

					if (isset($member_id) && $member_id > 0 && isset($content->id)) {

						//$purchased_sql = mysql_query("SELECT * FROM `cms_members_access` WHERE `member_id` = '" . $member_id . "' AND  `content_id` = '" . $content->id . "'") or die(mysql_error());
						$purchased_sql = mysql_query("SELECT * FROM cms_billing_purchases WHERE memberID = '" . $memberID . "' AND  relatedID = '0' AND itemID = '".$content->id."'") or die(mysql_error());

						if (mysql_num_rows($purchased_sql) == 1) {
							$userAllowed = TRUE;
						}
					}
				}
			}

			if ($userAllowed) {

				$finfo = finfo_open(FILEINFO_MIME_TYPE);
				$fileMime = finfo_file($finfo, $file);
				finfo_close($finfo);

				if (isset($fileMime) && $fileMime != "") {

					header('Content-type: ' . $fileMime);
					readfile($file);
					$fileSuccess = TRUE;

				}

			}
		}
	}

	if (!$fileSuccess) {
		header("HTTP/1.0 404 Not Found");
	}