Initial commit: OMSORG website + Mitarbeiter-App

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

mitarbeiter-app/pages/upload-serve.php

@@ -0,0 +1,21 @@
+<?php
+require_once __DIR__ . '/../lib/auth.php';
+require_admin();
+
+$file = basename($_GET['file'] ?? '');
+if ($file === '') { http_response_code(400); echo 'Ungültige Anfrage.'; exit; }
+
+$path = dirname(__DIR__) . '/uploads/' . $file;
+if (!is_file($path)) { http_response_code(404); echo 'Datei nicht gefunden.'; exit; }
+
+$display = $_GET['name'] ?? $file;
+$safe_display = addslashes($display);
+$safe_encoded = rawurlencode($display);
+
+header('Content-Type: application/octet-stream');
+header('Content-Disposition: attachment; filename="' . $safe_display . '"; filename*=UTF-8\'\'' . $safe_encoded);
+header('Content-Length: ' . filesize($path));
+header('X-Content-Type-Options: nosniff');
+header('Cache-Control: private, no-store');
+readfile($path);
+exit;