<?php
    $accepted_files = Array(
        'swf' => 'application/x-shockwave-flash'
      , 'xml' => 'text/xml'
    );

    $filename = '';
    if (isset($_GET) && isset($_GET['file'])) {
        $sep = (substr($_GET['file'], 0, 1) == '/' ? '' : DIRECTORY_SEPARATOR);
        $filename = dirname(__FILE__) . $sep . $_GET['file'];
    } else {
        die;
    }

    $type = substr($filename, -3);
    if (!in_array($type, array_keys($accepted_files))) {
        die;
    }

    header("Content-type: {$accepted_files[$type]}");
    header("Expires: Thu, 01 Jan 1970 00:00:00 GMT, -1 ");
    header("Cache-Control: no-cache, no-store, must-revalidate");
    header("Pragma: no-cache");

    echo file_get_contents($filename);
?>