@@ -625,6 +625,34 @@ def api_readme():
625625 return jsonify ({"success" : True , "message" : "Readme saved successfully" })
626626
627627
628+ @app .route ("/api/download" )
629+ def api_download ():
630+ """Download a file from a game folder"""
631+ from flask import send_file
632+
633+ folder_path = request .args .get ("folder" )
634+ relative_path = request .args .get ("path" )
635+
636+ if not folder_path or not relative_path :
637+ return jsonify ({"success" : False , "error" : "Missing folder or path parameter" }), 400
638+
639+ folder = LOG_BASE_DIR / folder_path
640+ if not folder .exists () or not folder .is_dir ():
641+ return jsonify ({"success" : False , "error" : "Invalid folder" }), 404
642+
643+ file_path = folder / relative_path
644+ if not file_path .exists () or not file_path .is_file ():
645+ return jsonify ({"success" : False , "error" : "File not found" }), 404
646+
647+ # Security check: ensure file is within the game folder
648+ try :
649+ file_path .resolve ().relative_to (folder .resolve ())
650+ except ValueError :
651+ return jsonify ({"success" : False , "error" : "Invalid file path" }), 403
652+
653+ return send_file (file_path , as_attachment = True , download_name = file_path .name )
654+
655+
628656# Catch-all route for React Router (must be last)
629657@app .errorhandler (404 )
630658def not_found (e ):
0 commit comments