Initial commit: OMSORG website + Mitarbeiter-App

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

mitarbeiter-app/pages/einsatzanweisung-serve.php

@@ -0,0 +1,40 @@
+<?php
+require_once __DIR__ . '/../lib/auth.php';
+require_login();
+
+$current = current_user();
+
+if (is_admin() && isset($_GET['user_id'])) {
+    $target_id = (int)$_GET['user_id'];
+} else {
+    $target_id = (int)$current['id'];
+}
+
+$stmt = db()->prepare('SELECT * FROM einsatzanweisung WHERE user_id = ?');
+$stmt->execute([$target_id]);
+$ea = $stmt->fetch();
+
+if (!$ea || $ea['filename'] === '') {
+    http_response_code(404);
+    echo 'Keine Datei gefunden.';
+    exit;
+}
+
+$path = dirname(__DIR__) . '/uploads/' . basename($ea['filename']);
+if (!is_file($path)) {
+    http_response_code(404);
+    echo 'Datei nicht gefunden.';
+    exit;
+}
+
+$display      = $ea['original_name'];
+$safe_display = addslashes($display);
+$safe_encoded = rawurlencode($display);
+
+header('Content-Type: application/pdf');
+header('Content-Disposition: attachment; filename="' . $safe_display . '"; filename*=UTF-8\'\'' . $safe_encoded);
+header('Content-Length: ' . filesize($path));
+header('X-Content-Type-Options: nosniff');
+header('Cache-Control: private, no-store');
+readfile($path);
+exit;