<!--- parameters --->
<CFSET WorkingDirectory = "C:\Inetpub\wwwroot\HR\Docs\">


<!--- security check --->
<CFIF Find( '..', URL.ServerFilePath )
   or not FindNoCase( WorkingDirectory, URL.ServerFilePath )
   >
   Error: You are not allowed to access this file
   <CFABORT>
</CFIF>


<!--- extract the file extension --->
<CFSET SeparatorPos = Find( '.', Reverse(URL.ServerFilePath) )>
<CFSET RevSolidusPos = Find( '\', Reverse(URL.ServerFilePath) )>
<CFIF SeparatorPos is 0> <!--- separator not found --->
   <CFSET FileExt = ''>
<CFELSEIF SeparatorPos gt RevSolidusPos> <!--- last separator before backslash --->
   <CFSET FileExt = ''>
<CFELSE>
   <CFSET FileExt = Right( URL.ServerFilePath, SeparatorPos - 1 )>
</CFIF>


<!--- find the proper MIME type --->
<CFIF FileExt is ''>         <CFSET FileType = "unknown">
<CFELSEIF FileExt is 'pdf'>      <CFSET FileType = "application/pdf">
<CFELSEIF FileExt is 'aif'>      <CFSET FileType = "audio/aiff">
<CFELSEIF FileExt is 'aiff'>   <CFSET FileType = "audio/aiff">
<CFELSEIF FileExt is 'art'>      <CFSET FileType = "image/x-jg">
<CFELSEIF FileExt is 'cil'>      <CFSET FileType = "application/vnd.ms-artgalry">
<CFELSEIF FileExt is 'gif'>      <CFSET FileType = "image/gif">
<CFELSEIF FileExt is 'htm'>      <CFSET FileType = "text/html">
<CFELSEIF FileExt is 'html'>   <CFSET FileType = "text/html">
<CFELSE>                  <CFSET FileType = "unknown">
</CFIF>


<!--- return requested file --->
<CFCONTENT TYPE="#FileType#" 
   FILE="#URL.ServerFilePath#"
>
