# Make Private Uploaded File

**URL:** <https://www.ruby-forum.com/t/make-private-uploaded-file/149238>\
**Category:** Rails\
**Created:** [September 22, 2008, 8:03pm UTC](https://www.ruby-forum.com/t/make-private-uploaded-file/149238 "2008-09-22T20:03:55Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![nik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/6de8d8/32.png) [@nik](https://www.ruby-forum.com/u/nik)\
**Post date:** [September 22, 2008, 8:03pm UTC](https://www.ruby-forum.com/t/make-private-uploaded-file/149238/1 "2008-09-22T20:03:55Z")

</div>

Hello all, I asked this question yesterday but seem to get no  
response, maybe there’s a code about how much I should explain before  
an answer is deserved or maybe it was confusingly stated. But let me  
try again:

If I were to allow users to upload files, say user A uploaded A.mov,  
and user B uploaded B.mov. I know that I can  
#User model  
has\_many :files

#File Model  
belongs\_to :user

to ensure that A only sees A.mov in his page and B only sees B.mov in  
his page.

But what if user A types in the url [http://dns/public/files/B.mov](http://dns/public/files/B.mov)?  
How does one usually go about that?

Thank you in advance for _any_ comment posted!

---

<div class="post-metadata">

**Author:** ![nik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/6de8d8/32.png) [@nik](https://www.ruby-forum.com/u/nik)\
**Post date:** [September 22, 2008, 8:07pm UTC](https://www.ruby-forum.com/t/make-private-uploaded-file/149238/2 "2008-09-22T20:07:26Z")

</div>

classical problem. to be resolved:

User.files.find(params[:id])

assuming, that params[:id] contains the file id.  
But however in detail, the main “trick” is to use  
User.files.find(…)  
instead of Files.find(…)  
since that will create an SQL query that checks not  
only for the file id, but for the user\_id column too.

---

<div class="post-metadata">

**Author:** ![nik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/6de8d8/32.png) [@nik](https://www.ruby-forum.com/u/nik)\
**Post date:** [September 23, 2008, 3:06am UTC](https://www.ruby-forum.com/t/make-private-uploaded-file/149238/3 "2008-09-23T03:06:42Z")

</div>

you might need to store the files outside of public and have rails  
serve them.  
i am still not very experienced with rails so i could be wrong.

---

<div class="post-metadata">

**Author:** ![nik](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/n/6de8d8/32.png) [@nik](https://www.ruby-forum.com/u/nik)\
**Post date:** [September 23, 2008, 3:43pm UTC](https://www.ruby-forum.com/t/make-private-uploaded-file/149238/4 "2008-09-23T15:43:35Z")

</div>

You might find this old blog post of mine useful:

[http://www.bencurtis.com/archives/2006/11/serving-protected-downloads-with-rails/](http://www.bencurtis.com/archives/2006/11/serving-protected-downloads-with-rails/)

–  
Benjamin C.  
[http://railskits.com/](http://railskits.com/) - Ready-made Rails code  
[http://catchthebest.com/](http://catchthebest.com/) - Team-powered recruiting  
[http://www.bencurtis.com/](http://www.bencurtis.com/) - Personal blog