# How to restrict access to images by user?

**URL:** <https://www.ruby-forum.com/t/how-to-restrict-access-to-images-by-user/58287>\
**Category:** Rails\
**Created:** [April 20, 2006, 9:18am UTC](https://www.ruby-forum.com/t/how-to-restrict-access-to-images-by-user/58287 "2006-04-20T09:18:44Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![budu](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/b5e925/32.png) [@budu](https://www.ruby-forum.com/u/budu)\
**Post date:** [April 20, 2006, 9:18am UTC](https://www.ruby-forum.com/t/how-to-restrict-access-to-images-by-user/58287/1 "2006-04-20T09:18:44Z")

</div>

Hi,

I have a some image files that belongs to some users. Only the owner of  
an  
image should be able to see it.  
How can I do that?  
I don’t think I can use send\_data, because I want the image to be  
displayed  
on a “rendered” page. I don’t think I can place the images in the public  
folder, because if some user can figure out the name of the image then  
he’ll  
be able to see it… what is the correct way to handle this?

Regards,

Nicolas

---

<div class="post-metadata">

**Author:** ![budu](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/b5e925/32.png) [@budu](https://www.ruby-forum.com/u/budu)\
**Post date:** [April 20, 2006, 9:21am UTC](https://www.ruby-forum.com/t/how-to-restrict-access-to-images-by-user/58287/2 "2006-04-20T09:21:45Z")

</div>

Take a look at mod\_secdownload if you use lighttpd.

---

<div class="post-metadata">

**Author:** ![budu](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/b5e925/32.png) [@budu](https://www.ruby-forum.com/u/budu)\
**Post date:** [April 20, 2006, 9:34am UTC](https://www.ruby-forum.com/t/how-to-restrict-access-to-images-by-user/58287/3 "2006-04-20T09:34:53Z")

</div>

Nicolas B. wrote:

> Hi,
> 
> I have a some image files that belongs to some users. Only the owner of  
> an  
> image should be able to see it.  
> How can I do that?  
> I don’t think I can use send\_data, because I want the image to be  
> displayed  
> on a “rendered” page. I don’t think I can place the images in the public  
> folder, because if some user can figure out the name of the image then  
> he’ll  
> be able to see it… what is the correct way to handle this?
> 
> Regards,
> 
> Nicolas

You could use file\_column and store the image file information in the  
database–they’d still live in your file system, but they’d be available  
as an ActiveRecord model which you could filter and display however you  
needed.

Jeff C.man

---

<div class="post-metadata">

**Author:** ![budu](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/b5e925/32.png) [@budu](https://www.ruby-forum.com/u/budu)\
**Post date:** [April 20, 2006, 9:46am UTC](https://www.ruby-forum.com/t/how-to-restrict-access-to-images-by-user/58287/4 "2006-04-20T09:46:23Z")

</div>

On 20/04/2006, at 7:15 PM, Nicolas B. wrote:

> I don’t think I can use send\_data, because I want the image to be  
> displayed on a “rendered” page.

def inline\_image  
image = Image.find(params[:id])

```
 if image.nil?
     redirect_to '/404.html' and return
 end

 if authorised_to_view?(session[:user], image)
     send_data image.data, :filename => image.file_name, :type =>

```

image.mime\_type, :disposition =\> ‘inline’  
else  
redirect\_to :controller =\> ‘images’, :action =\> ‘list’ and  
return  
end  
end