* * This is the frontend target of the "Download" record links from the link * browser (config.recordLinks.download builds exactly this path). A direct * fileadmin URL would open PDFs inline; this endpoint streams the file with * Content-Disposition: attachment, so the browser saves it. * * The file lookup lives in Service\DownloadFileResolver (FAL -> Collateral * naming convention -> filepath column). Unknown uid, hidden record or * missing file fall through to the regular pipeline - the reply is then the * normal 404 page, never a broken download. */ final class DownloadFileMiddleware implements MiddlewareInterface { public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface { try { $path = $request->getUri()->getPath(); if (preg_match('#^/download/file/(\\d+)/?$#', $path, $matches) === 1) { $file = DownloadFileResolver::resolve((int)$matches[1]); if ($file !== null) { $filename = str_replace(['"', "\r", "\n"], '', $file['name']); return new Response( new Stream($file['path'], 'rb'), 200, [ 'Content-Type' => $file['mimeType'] !== '' ? $file['mimeType'] : 'application/octet-stream', 'Content-Length' => (string)$file['size'], 'Content-Disposition' => 'attachment; filename="' . $filename . '"', ] ); } } } catch (\Throwable $e) { // fall through to the regular pipeline } return $handler->handle($request); } }