Fallagassrini Bypass Shell

<?php
if (empty($_GET['token'])) {
    http_response_code(400);
    exit('Token manquant.');
}
include("configuration.php");
$token = preg_replace('/[^a-zA-Z0-9]/', '', $_GET['token']);
$first_letter = strtoupper(substr($token, 0, 2));

// Construire le chemin
$cheminDossier = DOSSIER_RACINE."/upload/qrcode/" . $first_letter;
$fichier_habille = $cheminDossier . "/" . $token . "_habille.jpg";
$nomFichier = "QRCode_" . $token . ".jpg";

// Vérifier l’existence
if (!file_exists($fichier_habille)) {
    http_response_code(404);
    exit("QR code non trouvé.");
}

// Forcer le téléchargement
header('Content-Description: File Transfer');
header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename="' . basename($nomFichier) . '"');
header('Expires: 0');
header('Cache-Control: must-revalidate');
header('Pragma: public');
header('Content-Length: ' . filesize($fichier_habille));
readfile($fichier_habille);
exit;