# Image access control

**URL:** <https://www.ruby-forum.com/t/image-access-control/129359>\
**Category:** Rails\
**Created:** [February 17, 2008, 2:48pm UTC](https://www.ruby-forum.com/t/image-access-control/129359 "2008-02-17T14:48:49Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [February 17, 2008, 2:48pm UTC](https://www.ruby-forum.com/t/image-access-control/129359/1 "2008-02-17T14:48:49Z")

</div>

Hi all,

My app allows users to upload images, but access to the images needs  
to be controlled. For this reason, I’m not storing the images in the /  
public dir, I’m storing them elsewhere. What I need as an action that  
will verify the logged-in user’s access to an image, then render the  
image inline. I’ve been trying this but it doesn’t work:

class ImagesController \< ApplicationController  
before\_filter :verify\_user

def show  
@image = CmsImage.find(params[:id])  
send\_data(File.read(@image.full\_path), :type =\>  
@image.content\_type, :disposition =\> ‘inline’)  
rescue  
# image not found…  
end  
end

It just prints the URL used to access this action to the screen (in  
firefox). If I call this instead:

render :text =\> File.read(@image.full\_path)

then I get the contents of the image fill as text, so it’s reading the  
file OK. It just doesn’t display in the browser. Anyone got any idea  
how to solve this?

Many thanks,  
James

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [February 17, 2008, 3:57pm UTC](https://www.ruby-forum.com/t/image-access-control/129359/2 "2008-02-17T15:57:13Z")

</div>

Quick update: I found I could use ImageMagick do deliver the data, but  
it’s pretty damn slow. Any know a faster way?

## ---- Model cms\_image.rb ----

require ‘RMagick’  
class CmsImage  
def image\_data  
Magick::Image.read(full\_path).first.to\_blob  
end  
end

## ---- Controller images\_controller.rb ----

class ImagesController \< ApplicationController  
before\_filter :verify\_user

def show  
@image = CmsImage.find(params[:id])  
send\_data(@image.image\_data, :type =\>  
@image.content\_type, :disposition =\> ‘inline’)  
rescue  
# image not found…  
end  
end

On Feb 17, 1:47 pm, “removed\_email\_address@domain.invalid” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)