1
HTTP/1.1 200 OK
2
Date: Sat, 17 Oct 2026 13:26:26 GMT
3
Server: Apache/2.4.41 (Ubuntu)
4
Set-Cookie: PHPSESSID=ud2upre4qgu0d6st9agoao6nuo; path=/
5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
6
Cache-Control: no-store, no-cache, must-revalidate
7
Pragma: no-cache
8
Content-Type: text/html; charset=UTF-8

1
            <!-- FAQ 1 -->
2
            <div class="accordion-item">
3
                <h2 class="accordion-header" id="faqOne">
4
                    <button class="accordion-button" type="button" data-bs-toggle="collapse"
5
                            data-bs-target="#collapseOne" aria-expanded="true">
6
                        What is the Recruit API used for?
7
                    </button>
8
                </h2>
9
                <div id="collapseOne" class="accordion-collapse collapse show"
10
                     data-bs-parent="#apiFaq">
11
                    <div class="accordion-body">
12
                        The Recruit API is used internally to fetch and process candidate CVs
13
                        from external sources during the recruitment process.
14
                    </div>
15
                </div>
16
            </div>
17

18
            <!-- FAQ 2 -->
19
            <div class="accordion-item">
20
                <h2 class="accordion-header" id="faqTwo">
21
                    <button class="accordion-button collapsed" type="button" data-bs-toggle="collapse"
22
                            data-bs-target="#collapseTwo">
23
                        How can I fetch a candidate CV using the API?
24
                    </button>
25
                </h2>
26
                <div id="collapseTwo" class="accordion-collapse collapse"
27
                     data-bs-parent="#apiFaq">
28
                    <div class="accordion-body">
29
                        You can fetch a candidate CV using the following endpoint:
30
                        <pre class="mt-2"><code>/file.php?cv=&lt;URL&gt;</code></pre>
31
                    </div>
32
                </div>
33
            </div>
34

35
            <!-- FAQ 3 -->
36
            <div class="accordion-item">
37
                <h2 class="accordion-header" id="faqThree">
38
                    <button class="accordion-button collapsed" type="button" data-bs-toggle="collapse"
39
                            data-bs-target="#collapseThree">
40
                        What kind of URLs are supported?
41
                    </button>
42
                </h2>
43
                <div id="collapseThree" class="accordion-collapse collapse"
44
                     data-bs-parent="#apiFaq">
45
                    <div class="accordion-body">
46
                        The API supports fetching CVs from external URLs such as HTTP and HTTPS.
47
                    </div>
48
                </div>
49
            </div>
50

51
            <!-- FAQ 4 -->
52
            <div class="accordion-item">
53
                <h2 class="accordion-header" id="faqFour">
54
                    <button class="accordion-button collapsed" type="button" data-bs-toggle="collapse"
55
                            data-bs-target="#collapseFour">
56
                        Are there any security restrictions?
57
                    </button>
58
                </h2>
59
                <div id="collapseFour" class="accordion-collapse collapse"
60
                     data-bs-parent="#apiFaq">
61
                    <div class="accordion-body">
62
                        Requests targeting restricted locations may be blocked by the API.
63
                    </div>
64
                </div>
65
            </div>

1
<?php
2
if (!isset($_GET['cv'])) {
3
    die('Missing cv parameter');
4
}
5

6
$cv = $_GET['cv'];
7

8
/*
9
|--------------------------------------------------------------------------
10
| Allow only local file access
11
|--------------------------------------------------------------------------
12
*/
13
if (strpos($cv, 'file://') !== 0) {
14
    die('Only local files are allowed');
15
}
16

17
/*
18
|--------------------------------------------------------------------------
19
| Convert file:// to filesystem path
20
|--------------------------------------------------------------------------
21
*/
22
$filePath = str_replace('file://', '', $cv);
23

24
/*
25
|--------------------------------------------------------------------------
26
| Resolve real path to prevent traversal
27
|--------------------------------------------------------------------------
28
*/
29
$realPath = realpath($filePath);
30

31
/*
32
|--------------------------------------------------------------------------
33
| Restrict access to /var/www/html only
34
|--------------------------------------------------------------------------
35
*/
36
$allowedBase = '/var/www/html';
37

38
if ($realPath === false || strpos($realPath, $allowedBase) !== 0) {
39
    die('Access denied');
40
}
41

42
/*
43
|--------------------------------------------------------------------------
44
| Display file contents
45
|--------------------------------------------------------------------------
46
*/
47
header('Content-Type: text/plain');
48
echo file_get_contents($realPath);

1
<?php
2

3
/*
4
|--------------------------------------------------------------------------
5
| Application Configuration
6
|--------------------------------------------------------------------------
7
*/
8

9
$APP_NAME        = 'Recruit';
10
$APP_ENV         = 'production';
11
$APP_VERSION     = '1.2.4';
12
$APP_DEBUG       = false;
13

14
/*
15
|--------------------------------------------------------------------------
16
| HR Credentials (Temporary – Initial Rollout Phase)
17
|--------------------------------------------------------------------------
18
| NOTE:
19
| These credentials are stored here temporarily for ease of access
20
| during the initial deployment and will be moved to the database
21
| in a future release.
22
*/
23

24
$HR_PASSWORD = 'hrpassword123';
25

26
/*
27
|--------------------------------------------------------------------------
28
| API Configuration
29
|--------------------------------------------------------------------------
30
*/
31

32
$API_ENABLED     = true;
33
$API_VERSION     = 'v1';
34

35
?>