    public function getZipFile($path) {
        $filename = basename($path);

        // echo "<pre>";
        // echo $path."\n";
        // echo $filename."\n";
        // echo "isFile => ".is_file($path) ? 'isFile' : 'isNoFile'."\n";
        // echo "</pre>";
        if (is_file($path) || true) {
            // Send the file for download!
            header("Expires: 0");
            header("Cache-Control: must-revalidate");
            header("Content-Type: application/force-download");
            header("Content-Disposition: attachment; filename=$filename");
            header("Content-Description: File Transfer");

            @readfile($path);

            // Delete the temporary file
            unlink($path);
        }
    }
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.