<?php
require_once __DIR__.'/../app/bootstrap.php';
require_once __DIR__.'/_layout.php';
$user=require_login($pdo);
$id=(int)($_GET['id']??0);
$stmt=$pdo->prepare('SELECT q.logo_path FROM '.qtbl('qr_codes').' q WHERE q.id=? AND '.qr_access_where('q'));
$stmt->execute([$id,$user['id'],$user['id']]);
$path=$stmt->fetchColumn();
if(!$path || !preg_match('/^logos\/[A-Za-z0-9]+\.(png|jpg|gif|webp)$/',$path)){ http_response_code(404); exit; }
$file=__DIR__.'/../storage/'.$path;
if(!is_file($file)){ http_response_code(404); exit; }
$info=@getimagesize($file);
if(!$info || empty($info['mime'])){ http_response_code(404); exit; }
header('Content-Type: '.$info['mime']);
header('Cache-Control: private, max-age=3600');
readfile($file);
