<?php
require_once __DIR__ . '/security.php';
enrep_require_user();

$path = enrep_safe_relative_path(enrep_request_string('afl', '', 255));
if (!preg_match('#\Aimages/company/[A-Za-z0-9._/\- ]+\z#', $path)) {
    enrep_fail(400, 'Invalid image');
}

$base = realpath(__DIR__ . '/..');
$target = realpath($base . '/' . $path);

if ($target !== false && strpos($target, $base . DIRECTORY_SEPARATOR . 'images' . DIRECTORY_SEPARATOR . 'company' . DIRECTORY_SEPARATOR) === 0 && is_file($target)) {
    unlink($target);
}

echo 'done';
