# Prevent user from accessing an image

**URL:** <https://www.ruby-forum.com/t/prevent-user-from-accessing-an-image/65513>\
**Category:** Rails\
**Created:** [August 18, 2006, 9:03pm UTC](https://www.ruby-forum.com/t/prevent-user-from-accessing-an-image/65513 "2006-08-18T21:03:16Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Marcello\_P](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/fbc32d/32.png) [@Marcello\_P](https://www.ruby-forum.com/u/Marcello_P)\
**Post date:** [August 18, 2006, 9:03pm UTC](https://www.ruby-forum.com/t/prevent-user-from-accessing-an-image/65513/1 "2006-08-18T21:03:16Z")

</div>

Hello,

I’m using file\_column to save my users images.  
It’s all OK, but I want to prevent one user from accessing other user’s  
image.  
Is it possible, as the image is saved in the file system ??

Thanks

Parra

---

<div class="post-metadata">

**Author:** ![Marcello\_P](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/fbc32d/32.png) [@Marcello\_P](https://www.ruby-forum.com/u/Marcello_P)\
**Post date:** [August 18, 2006, 9:54pm UTC](https://www.ruby-forum.com/t/prevent-user-from-accessing-an-image/65513/2 "2006-08-18T21:54:22Z")

</div>

Has anyone gotten the DhtmlCalendar plugin/engine working?

I installed the plugin and also the engine plugin and followed all the  
instructions. I can’t get past “undefined method ‘popup\_calendar’”.

Also it is unclear to me if the inclusion of the line below means I must  
install the dry\_scaffold engine as well.

Engines.start :dry\_scaffold

---

<div class="post-metadata">

**Author:** ![Marcello\_P](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/fbc32d/32.png) [@Marcello\_P](https://www.ruby-forum.com/u/Marcello_P)\
**Post date:** [August 18, 2006, 9:12pm UTC](https://www.ruby-forum.com/t/prevent-user-from-accessing-an-image/65513/3 "2006-08-18T21:12:25Z")

</div>

Marcello P. wrote:

> I’m using file\_column to save my users images.  
> It’s all OK, but I want to prevent one user from accessing other user’s  
> image.  
> Is it possible, as the image is saved in the file system ??

Once you figure out the change to make file\_column store in a  
non-public directory (see ‘Uploading files to a directory outside of the  
RAILS\_ROOT’ at  
[http://wiki.rubyonrails.org/rails/pages/HowToUseFileColumn](http://wiki.rubyonrails.org/rails/pages/HowToUseFileColumn))

then you can use send\_file to ‘serve’ up images from your actions with  
the appropriate security.

See this thread for more information:

[http://lists.rubyonrails.org/pipermail/rails/2006-June/046458.html](http://lists.rubyonrails.org/pipermail/rails/2006-June/046458.html)

Jeff

---

<div class="post-metadata">

**Author:** ![Marcello\_P](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/fbc32d/32.png) [@Marcello\_P](https://www.ruby-forum.com/u/Marcello_P)\
**Post date:** [November 7, 2006, 11:00am UTC](https://www.ruby-forum.com/t/prevent-user-from-accessing-an-image/65513/4 "2006-11-07T11:00:07Z")

</div>

> I installed the plugin and also the engine plugin and followed all the  
> instructions. I can’t get past “undefined method ‘popup\_calendar’”.  
> I’ve been trough the same thing right now, on:  
> [Peak Obsession](http://wiki.rubyonrails.com/rails/pages/CalendarHelper)  
> I’ve correct two errors (typos) about the helper’s name you need to  
> include  
> Enrico

–  
“The only thing necessary for the triumph of evil  
is for good men to do nothing”  
Edmund Burke

---

<div class="post-metadata">

**Author:** ![Marcello\_P](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/fbc32d/32.png) [@Marcello\_P](https://www.ruby-forum.com/u/Marcello_P)\
**Post date:** [November 7, 2006, 11:01am UTC](https://www.ruby-forum.com/t/prevent-user-from-accessing-an-image/65513/5 "2006-11-07T11:01:23Z")

</div>

Anyway the value you choose from the popup calendar (using  
calendar\_field helper) is not reported to the text box.  
Has anybody succesfully used that plugin’s calendar\_field helper?  
Thanks

–  
“The only thing necessary for the triumph of evil  
is for good men to do nothing”  
Edmund Burke

---

<div class="post-metadata">

**Author:** ![Marcello\_P](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/fbc32d/32.png) [@Marcello\_P](https://www.ruby-forum.com/u/Marcello_P)\
**Post date:** [August 18, 2006, 10:21pm UTC](https://www.ruby-forum.com/t/prevent-user-from-accessing-an-image/65513/6 "2006-08-18T22:21:25Z")

</div>

This is what I need…  
Thanks Jeff