<!--#include file="conn.asp"-->
<!--#include file="config.asp"-->
<!--#include file="char.inc"-->
<%
From_url = Cstr(Request.ServerVariables("HTTP_REFERER"))
Serv_url = Cstr(Request.ServerVariables("SERVER_NAME"))
If mid(From_url,8,len(Serv_url)) <> Serv_url then
	Response.Write "非法链接！" '防止盗链
	Response.End
End if

Dim Stream
Dim Contents
Dim FileName
Dim TrueFileName
Dim FileExt
Dim SavePath

Const adTypeBinary = 1
FileName = Request.QueryString("FileName")
If FileName = "" Then
	Response.Write "无效文件名！"
	Response.End
End if

'SQL注入检测
FileName =ChkRequest(FileName, 0)

'验证在上传文件表（db_wygkcn_Attach_Table）中是否存在，存在的才允许下载
Dim Rs, Sql
Set Rs=server.CreateObject("ADODB.RecordSet")
Sql = "SELECT EC_ArticleID FROM "& db_wygkcn_Attach_Table &" WHERE filename='"& FileName &"'"
Rs.Open Sql, Conn, 1, 1
If (Rs.BOF Or Rs.EOF) Then
	Response.Write "此文件不存在！"
	Response.End
Else
	FileExt = Mid(FileName, InStrRev(FileName, ".") + 1)
	Select Case UCase(FileExt)
		Case "ASP", "ASA", "ASPX", "ASAX", "MDB"
			Response.Write "非法操作！"
			Response.End
	End Select
	Response.Clear
	if lcase(right(FileName,3))="gif" or lcase(right(FileName,3))="jpg" or lcase(right(FileName,3))="png" then
		Response.ContentType = "image/*" '对图像文件不出现下载对话框
	else
		Response.ContentType = "application/ms-download"
	end if
	Response.AddHeader "content-disposition", "attachment; filename=" & GetFileName(Request.QueryString("FileName"))
	Set Stream = server.CreateObject("ADODB.Stream")
	Stream.Type = adTypeBinary
	Stream.Open

	SavePath = FileUploadPath		'存放上传文件的目录
	TrueFileName = SavePath & FileName

	Stream.LoadFromFile Server.MapPath(TrueFileName)
	While Not Stream.EOS
		Response.BinaryWrite Stream.Read(1024 * 64)
	Wend
	Stream.Close
	Set Stream = Nothing
	Response.Flush
	Response.End
End if

Function GetFileName(longname)	'/folder1/folder2/file.asp=>file.asp
	While instr(longname,"/")
		longname = right(longname,len(longname)-1)
	Wend
	GetFileName = longname
End Function
%>