Robert Evans

A current project I am working on, actually two projects, require files to be protected. To do so, you need to keep the files outside of the public directory, yet allow your users, if they have permission to be able to have access to those files when they so desire. You could use a redirect in an htaccess file, but then how Rubyish is that.

I’ve grown accustomed to using File Column, but I don’t like having to use form_tag in forms as the unhacked way of using it. So, lately I have been using Rick Olson’s Acts as Attachment plugin for all my file upload needs and I have to say I am quite impressed with it.

In this mini article, I’ll show you how I’m currently using it to store files outside the public directory, yet still allow access for users to download those files, if they have permission to access them.

Let’s look at the model setup first:

  acts_as_attachment :storage => :file_system, :file_system_path => 'files/downloads'
  validates_as_attachment

This is a simple setup for acts as attachment. :storage takes the value of :file_system which means we are going to use the file system instead of the database to store our files. The :file_system_path takes the value of where you are going to store your files when they are uploaded. Simple enough, right?

Next, let’s look at the routes:

  map.files 'files/*path', :controller => 'pages', :action => 'download'

This part is important. ‘*path’ will take our path that we send to it, via the download method within our “page” (or whatever you choose to name it). If you don’t include this part, you will get an error when you try to allow your users to access their files for download or your server could be open to attack.

Now, let’s look at the view:

  <%= link_to page.filename, :controller => "pages", 
                                               :action => "download", 
                                               :path => page.public_filename
  %>

This is just a simple link_to, passing the page.filename as the name of our file to be displayed with as a link. The pages controller contains our download method that will be called to handle sending the file for the user to download. :path is contains the page.public_filename which contains the public path to the file.

Let’s take a look at the controller now:

  def download
    path = params[:path].join('/').reverse.chomp('/').reverse
    send_file(path)
  end 

This is the download method and it is quite simple. We take the path that is passed from our link in the view. The path variable is an array and in this case, the array would look something like this: [“files”, “downloads”, “1”, “file.doc”]. We take that array, join it with our forward slashes. We then pass this string to the send_file method, which will then send the file to the user as a download.

Simple, huh? Next thing you would need to do, is setup user permissions so that specific users only have access to their files, but that is out of the scope of this little tutorial.

I’d love to hear others are doing this and if you have found this to be helpful and if you have suggestions of something you’d like to see here, just leave me a comment and I’ll try to put something together.