# Attachement\_fu and protecting files from download **URL:** \ **Category:** Rails\ **Created:** [July 10, 2007, 5:48pm UTC](https://www.ruby-forum.com/t/attachement-fu-and-protecting-files-from-download/109015 "2007-07-10T17:48:08Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![jochen\_kaechelin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/48db29/32.png) [@jochen\_kaechelin](https://www.ruby-forum.com/u/jochen_kaechelin)\ **Post date:** [July 10, 2007, 5:48pm UTC](https://www.ruby-forum.com/t/attachement-fu-and-protecting-files-from-download/109015/1 "2007-07-10T17:48:08Z")
I successfully installed attachement\_fu but I still have one question: How can I protect my uploaded files from being downloaded like [http://127.0.0.1:3000/images/galleries/0000/0001/1.jpg](http://127.0.0.1:3000/images/galleries/0000/0001/1.jpg) I only what logged in users to download images? Thanx. – Jochen K. [gissmoh.de](http://gissmoh.de), [figgfrosch.de](http://figgfrosch.de), [ror-ror.de](http://ror-ror.de) ---
**Author:** ![jochen\_kaechelin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/48db29/32.png) [@jochen\_kaechelin](https://www.ruby-forum.com/u/jochen_kaechelin)\ **Post date:** [July 10, 2007, 6:15pm UTC](https://www.ruby-forum.com/t/attachement-fu-and-protecting-files-from-download/109015/2 "2007-07-10T18:15:12Z")
jochen kaechelin wrote: > This has been asked a few times in the past (though I don’t have links handy) but basically: 1. You’ll need to save files to a non-public directory (I’ve done this with file\_column but I expect it’s possible also with attachment\_fu) 2. Add a controller action that will use send\_file to send the file to the browser 3. Add a before\_filter to make sure that the user is logged in. Cheers, Mohit. 7/11/2007 | 12:13 AM. ---
**Author:** ![jochen\_kaechelin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/48db29/32.png) [@jochen\_kaechelin](https://www.ruby-forum.com/u/jochen_kaechelin)\ **Post date:** [July 11, 2007, 2:57am UTC](https://www.ruby-forum.com/t/attachement-fu-and-protecting-files-from-download/109015/3 "2007-07-11T02:57:32Z")
On Jul 10, 8:47 am, jochen kaechelin [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > – > Jochen K. > [gissmoh.de](http://gissmoh.de), [figgfrosch.de](http://figgfrosch.de), [ror-ror.de](http://ror-ror.de) google for “protected download” or “secure download” or authenticated, etc [http://www.bencurtis.com/archives/2006/11/serving-protected-downloads-with-rails/](http://www.bencurtis.com/archives/2006/11/serving-protected-downloads-with-rails/) [http://robertrevans.com/article/files-outside-public-directory](http://robertrevans.com/article/files-outside-public-directory) > **[Working with files in Rails - Ruby on Rails Security Project](https://rorsecurity.info/journal/2007/03/27/working-with-files-in-rails.html)** > >   In many cases web applications save user entered data to files and deliver file uploads. You should always filter file names that come directly from the user, as an attacker could use a malicious file name to download or overwrite any file on... ---
**Author:** ![jochen\_kaechelin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/48db29/32.png) [@jochen\_kaechelin](https://www.ruby-forum.com/u/jochen_kaechelin)\ **Post date:** [July 11, 2007, 3:03am UTC](https://www.ruby-forum.com/t/attachement-fu-and-protecting-files-from-download/109015/4 "2007-07-11T03:03:32Z")
You might also be interested in this discussion: [http://groups.google.com/group/WellRailed/browse\_thread/thread/b2b925ea74a605df/](http://groups.google.com/group/WellRailed/browse_thread/thread/b2b925ea74a605df/) Cheers, Walter ---
**Author:** ![jochen\_kaechelin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/48db29/32.png) [@jochen\_kaechelin](https://www.ruby-forum.com/u/jochen_kaechelin)\ **Post date:** [July 11, 2007, 3:05am UTC](https://www.ruby-forum.com/t/attachement-fu-and-protecting-files-from-download/109015/5 "2007-07-11T03:05:33Z")
Correction. send\_data and not send\_file. -Pratik On 7/10/07, Mohit S. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > > > 1. Add a before\_filter to make sure that the user is logged in. > > Cheers, > Mohit. > 7/11/2007 | 12:13 AM. > > > – [http://m.onkey.org](http://m.onkey.org) ---
**Author:** ![jochen\_kaechelin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/48db29/32.png) [@jochen\_kaechelin](https://www.ruby-forum.com/u/jochen_kaechelin)\ **Post date:** [July 11, 2007, 6:29am UTC](https://www.ruby-forum.com/t/attachement-fu-and-protecting-files-from-download/109015/6 "2007-07-11T06:29:49Z")
Pratik wrote: > Correction. send\_data and not send\_file. > > -Pratik Thanks! Of course, that’s what I meant 😛 Cheers, Mohit. 7/11/2007 | 12:28 PM.