# Folder question....routing error

**URL:** <https://www.ruby-forum.com/t/folder-question-routing-error/107862>\
**Category:** Rails\
**Created:** [June 26, 2007, 11:03pm UTC](https://www.ruby-forum.com/t/folder-question-routing-error/107862 "2007-06-26T23:03:37Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![maestro777](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/ee7513/32.png) [@maestro777](https://www.ruby-forum.com/u/maestro777)\
**Post date:** [June 26, 2007, 11:03pm UTC](https://www.ruby-forum.com/t/folder-question-routing-error/107862/1 "2007-06-26T23:03:37Z")

</div>

I have this scenario:

A Controller called Product.

I have a folder set up as /app/views/product/product1/documents  
and a document called test.pdf residing in the above folder.

I have a view file called full\_list.rhtml residing in /app/views/  
product/product1.  
And in full\_list.rhtml I have this link Test.pdf

When I click that link, I get this error:  
no route found to match “/product/product1/documents/test.pdf”  
with {:method=\>:get}

Obviously I’m not doing things right. But I just don’t know what it is  
I’m not doing right.

A second question concerning good ROR practices - where in the ROR  
directory structure should I put documents (such as test.pdf) that I  
wish user to have access to? Since these are restricted documents, I’m  
concerned about having them in the public folder.

Any help would be greatly appreciated since I have spent hours trying  
to figure this thing out.

Many thanks.  
Steve

---

<div class="post-metadata">

**Author:** ![maestro777](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/ee7513/32.png) [@maestro777](https://www.ruby-forum.com/u/maestro777)\
**Post date:** [June 26, 2007, 11:56pm UTC](https://www.ruby-forum.com/t/folder-question-routing-error/107862/2 "2007-06-26T23:56:43Z")

</div>

> A second question concerning good ROR practices - where in  
> the ROR directory structure should I put documents (such as  
> test.pdf) that I wish user to have access to? Since these are  
> restricted documents, I’m concerned about having them in the  
> public folder.

You can put them anywhere but public. Anything in public bypasses rails  
and is served directly by the web server. Anyone that knows the URL has  
access to the information. I historically have created a sibling  
directory to public called protected, and I place my protected documents  
there. I then use a route like so:

config/routes.rb

# Static content control

map.connect ‘/protected/\*path’, :controller =\> ‘protected’, :action =\>  
‘render\_static’

So that rails will be invoked and call the render\_static action on any  
attempted access to data in this folder tree. Then, things get a bit  
messy. First, you must determine if the requester is authorized to the  
material. Then, if the material is an html file, you need to render it  
using the ‘render’ method, otherwise, you need to compute the mimetype  
of the file and use the ‘send\_file’ method to send it. An exercise, as  
they say, for the reader.

app/controllers/protected\_controller.rb

def render\_static(mimetype="", disposition=“inline”)  
requested\_file = params[:path].to\_s

```
# render or send_file, as you please

```

end

You probably want to make sure that no one can initiate a directory  
traversal attack, via some magic like ‘…/…/…/etc/passwd’ and such  
too. I’m not sure if rails protects you from such things or not.  
Lastly, if the requested data is not on file, or not authorized, you may  
wish to render /public/404.html or similar.

HTH

Regards,  
Rich