cv.php

<?php
$ip = $_SERVER['REMOTE_ADDR'] ?? 'unknown';
$rlKey = md5('cv_' . $ip);
$rlDir = __DIR__ . '/temp/rate-limits/';
if (!is_dir($rlDir)) @mkdir($rlDir, 0755, true);
$rlFile = $rlDir . $rlKey . '.lock';
$rlNow = time();
$rlWindow = (int)floor($rlNow / 60);
$rlFp = fopen($rlFile, 'c+');
if ($rlFp && flock($rlFp, LOCK_EX)) {
    $rlData = [];
    $rlSize = @filesize($rlFile);
    if ($rlSize && $rlSize > 0) {
        $rlContents = fread($rlFp, $rlSize);
        if ($rlContents) $rlData = json_decode($rlContents, true) ?: [];
    }
    if ($rlData && isset($rlData['w']) && $rlData['w'] === $rlWindow && $rlData['h'] > 30) {
        flock($rlFp, LOCK_UN);
        fclose($rlFp);
        http_response_code(429);
        echo '429 Too Many Requests';
        exit;
    }
    $rlData = $rlData && $rlData['w'] === $rlWindow ? ['w' => $rlWindow, 'h' => $rlData['h'] + 1] : ['w' => $rlWindow, 'h' => 1];
    ftruncate($rlFp, 0);
    rewind($rlFp);
    fwrite($rlFp, json_encode($rlData));
    flock($rlFp, LOCK_UN);
    fclose($rlFp);
}

$whitelist = ['vi' => 'cv_hoang_VI.html', 'en' => 'cv_hoang_EN.html'];

$lang = $_GET['lang'] ?? '';
$lang = preg_replace('/[^a-z]/', '', $lang);

if (!array_key_exists($lang, $whitelist)) {
    http_response_code(404);
    echo '404 Not Found';
    exit;
}

$file = __DIR__ . '/' . $whitelist[$lang];
if (!is_file($file) || !is_readable($file)) {
    http_response_code(500);
    echo '500 Internal Server Error';
    exit;
}

$photoPath = '';
try {
    require_once __DIR__ . '/config/database.php';
    $database = new Database();
    $db = $database->getConnection();
    if ($db) {
        $stmt = $db->query("SELECT hero_image FROM profile LIMIT 1");
        $profile = $stmt->fetch();
        if ($profile && !empty($profile['hero_image'])) {
            $photoPath = $profile['hero_image'];
        }
    }
} catch (Exception $e) {
    error_log("CV photo query failed: " . $e->getMessage());
}

$html = file_get_contents($file);
if ($photoPath) {
    $html = str_replace('__PHOTO__', $photoPath, $html);
}

header('Content-Type: text/html; charset=utf-8');
header('X-Content-Type-Options: nosniff');
header('X-Frame-Options: DENY');
header('Referrer-Policy: strict-origin-when-cross-origin');

http_response_code(200);
echo $html;
exit;