# File Management by User Permissions

**URL:** <https://www.ruby-forum.com/t/file-management-by-user-permissions/74144>\
**Category:** Rails\
**Created:** [October 31, 2006, 4:35am UTC](https://www.ruby-forum.com/t/file-management-by-user-permissions/74144 "2006-10-31T04:35:26Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![roland](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/3ab097/32.png) [@roland](https://www.ruby-forum.com/u/roland)\
**Post date:** [October 31, 2006, 4:35am UTC](https://www.ruby-forum.com/t/file-management-by-user-permissions/74144/1 "2006-10-31T04:35:26Z")

</div>

Hi,

I was wondering what would be the best practices to handle a file  
managing system that needs to restrict files to users according to their  
authentication.

If I were to put all uploaded files in /public/files one can always get  
the url from someone else and still be able to download the file, so I  
don’t really like that method. I would prefer a before\_filter approach,  
but there is no such thing when talking about /public

Any ideas?

Roland

---

<div class="post-metadata">

**Author:** ![roland](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/3ab097/32.png) [@roland](https://www.ruby-forum.com/u/roland)\
**Post date:** [October 31, 2006, 3:30pm UTC](https://www.ruby-forum.com/t/file-management-by-user-permissions/74144/2 "2006-10-31T15:30:39Z")

</div>

try loginGenerator and use another folder to upload the files?

i also would like do what you are doing.

i believe you can just look at session and if its valid, allow them  
access to a folder.

---

<div class="post-metadata">

**Author:** ![roland](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/3ab097/32.png) [@roland](https://www.ruby-forum.com/u/roland)\
**Post date:** [October 31, 2006, 5:24pm UTC](https://www.ruby-forum.com/t/file-management-by-user-permissions/74144/3 "2006-10-31T17:24:32Z")

</div>

Serving up a file download is really just sending the data of that file  
in encoded format with the appropriate headers, right? So, conceivably,  
you could store the files in an inaccessible folder, and when someone  
wants a download, your application checks security, then opens and reads  
a file from the inaccessible folder, then encodes and passes the data  
back to the requesting user with the appropriate header information for  
it to be recived as a file download.

No one else can use that link because it is security-checked against the  
user.

Just a thought - I have no idea what kind of performance issues this  
might introduce into your application.

Keep in mind also, this prevents someone from passing the link to a  
friend, but there’s no way you can keep them from just downloading the  
file and sending that to their friend. You haven’t really made the  
process of sharing a downloaded file that much more difficult. So, the  
question would be do you really want to devote all this effort to what  
is, at best, a thin veil of protection?

c.

Roland M. wrote:

> mixplate wrote:
> 
> > try loginGenerator and use another folder to upload the files?
> > 
> > i also would like do what you are doing.
> > 
> > i believe you can just look at session and if its valid, allow them  
> > access to a folder.
> 
> The authentication portion is not a problem here, however, I prefer the  
> login/user engine.
> 
> As you say that’s the logic but actually implementing, it’s what’s  
> bugging me. Routing to files is done differently than routing to  
> functions.  
> Here are the options I am considering but with little promise:
> 
> 1. Place permissions on files and change permissions to read/write when  
> an authenticated user tried to access the file. Drawback: When do you  
> change back the permissions? Time to transfer is vulnerability time.
> 
> 2. Storing the files in a database. Drawback: Space issues may affect  
> database performance.
> 
> I am sure there has been some RoR project such as a music store or  
> ebook store that allowed you to download files from, but have not found  
> a method online yet.
> 
> Thanks for contributing,
> 
> Roland

---

<div class="post-metadata">

**Author:** ![roland](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/3ab097/32.png) [@roland](https://www.ruby-forum.com/u/roland)\
**Post date:** [October 31, 2006, 3:38pm UTC](https://www.ruby-forum.com/t/file-management-by-user-permissions/74144/4 "2006-10-31T15:38:39Z")

</div>

mixplate wrote:

> try loginGenerator and use another folder to upload the files?
> 
> i also would like do what you are doing.
> 
> i believe you can just look at session and if its valid, allow them  
> access to a folder.

The authentication portion is not a problem here, however, I prefer the  
login/user engine.

As you say that’s the logic but actually implementing, it’s what’s  
bugging me. Routing to files is done differently than routing to  
functions.  
Here are the options I am considering but with little promise:

1. Place permissions on files and change permissions to read/write when  
an authenticated user tried to access the file. Drawback: When do you  
change back the permissions? Time to transfer is vulnerability time.

2. Storing the files in a database. Drawback: Space issues may affect  
database performance.

I am sure there has been some RoR project such as a music store or  
ebook store that allowed you to download files from, but have not found  
a method online yet.

Thanks for contributing,

Roland