# Restricting access to files uploaded by file\_column

**URL:** <https://www.ruby-forum.com/t/restricting-access-to-files-uploaded-by-file-column/62078>\
**Category:** Rails\
**Created:** [May 31, 2006, 9:34am UTC](https://www.ruby-forum.com/t/restricting-access-to-files-uploaded-by-file-column/62078 "2006-05-31T09:34:12Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![donsdgr81](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/b2d939/32.png) [@donsdgr81](https://www.ruby-forum.com/u/donsdgr81)\
**Post date:** [May 31, 2006, 9:34am UTC](https://www.ruby-forum.com/t/restricting-access-to-files-uploaded-by-file-column/62078/1 "2006-05-31T09:34:12Z")

</div>

Hi Guys,

Does anyone know how to restrict access on files that you upload in file  
column to certain users only? I notice that files being saved by the  
file\_column by default are being saved under the public folder and can  
be accessed just by typing the URL directly. Let’s say you have a Login  
system where you restrict access to some pages and allow those users to  
upload their own files, I also want those files to be secured and only  
allow users who uploaded those files to be able to access it.

Thanks.

Regards,  
Dons

---

<div class="post-metadata">

**Author:** ![donsdgr81](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/b2d939/32.png) [@donsdgr81](https://www.ruby-forum.com/u/donsdgr81)\
**Post date:** [May 31, 2006, 12:30pm UTC](https://www.ruby-forum.com/t/restricting-access-to-files-uploaded-by-file-column/62078/2 "2006-05-31T12:30:49Z")

</div>

Does anyone have an idea how to do this or if it’s possible? Aside from  
this one the only thing I could think of to secure the data is storing  
the files to the database which I’m trying to avoid.

---

<div class="post-metadata">

**Author:** ![donsdgr81](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/b2d939/32.png) [@donsdgr81](https://www.ruby-forum.com/u/donsdgr81)\
**Post date:** [May 31, 2006, 6:27pm UTC](https://www.ruby-forum.com/t/restricting-access-to-files-uploaded-by-file-column/62078/3 "2006-05-31T18:27:56Z")

</div>

That would only provide true protection if the images were stored in the  
database - something Donald is trying to avoid.

This is a problem that has trouble many a web developer over the years.  
A common method is to run all of your images via script that redirects  
to the image:

![](https://www.ruby-forum.com/myimagecontroller/view/imagename.jpg)

…  
class ImageController \< ApplicationController  
def view  
redirect\_to(’/images/’+params[:image])  
end  
end  
…  
(Note: i have no idea whether the above would work - it should  
demonstrate the idea though)

In that case you apply the before\_filter as usual. However, this still  
would protect the images fully as you could still manually type the  
address in. That would require guesswork of course and if you kept the  
image names/dirs as numbers mapping to filenames in the db (1234 =\>  
‘imagename.jpg’) it should be reasonably secure.

If you need things to be more secure than that, you could store the  
images in a non-web accessible dir and open the images server side to  
push to the browser - that’d probably incur a fairly big processing hit  
though :0)

I don’t know whether you could use htaccess to deny or allow directories  
based cookies or something - in which case you could set a value that  
apache picks up when the file is requested.

Anyway - a lot of that is rambling but hopefully some of it is useful  
:0)

Steve

---

<div class="post-metadata">

**Author:** ![donsdgr81](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/b2d939/32.png) [@donsdgr81](https://www.ruby-forum.com/u/donsdgr81)\
**Post date:** [May 31, 2006, 6:08pm UTC](https://www.ruby-forum.com/t/restricting-access-to-files-uploaded-by-file-column/62078/4 "2006-05-31T18:08:51Z")

</div>

I’m doing something similar. When you upload a file, associate the user  
who did the upload with the file.

Then when someone tries to access a file, run a before filter on the  
action that allows people to access a file.  
In the before filter check if the person trying to access the file is  
the same person who uploaded the file.

-Steven

---

<div class="post-metadata">

**Author:** ![donsdgr81](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/b2d939/32.png) [@donsdgr81](https://www.ruby-forum.com/u/donsdgr81)\
**Post date:** [May 31, 2006, 7:34pm UTC](https://www.ruby-forum.com/t/restricting-access-to-files-uploaded-by-file-column/62078/5 "2006-05-31T19:34:30Z")

</div>

I think my situation is a bit different as I am not displaying files,  
but allowing people to download them.  
I’ve put the directory that stores the images below the web root and  
since the downloads are one offs, opening  
the file server side isn’t really a problem.

I’m probably talking out of my %$^#&\*, but what if you used AJAX? For  
each image you want to display, make an  
Ajax call to the relevant controller::action. Yes this would be slower  
than having the webserver send the image without  
getting ruby involved, but might it be fast enough?

-Steven

---

<div class="post-metadata">

**Author:** ![donsdgr81](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/b2d939/32.png) [@donsdgr81](https://www.ruby-forum.com/u/donsdgr81)\
**Post date:** [May 31, 2006, 7:56pm UTC](https://www.ruby-forum.com/t/restricting-access-to-files-uploaded-by-file-column/62078/6 "2006-05-31T19:56:20Z")

</div>

What I did is put it in a directory not accessible to the web server,  
and serve it with send\_file. Still beats storing it in the DB. But for  
publicly accessible files I also did a special rewrite on lighty (a  
similar thing could be done with apache) to point to symlinks into the  
private area.

This way public files can be accessed without Rails interaction, but  
private files still go through rails with all the security.

I described what I did (it’s a bit different now and I can help you  
get it going if you need to) so you can see how to do it on your  
system:

> **[FamUndo.com is for sale | HugeDomains](https://www.hugedomains.com/domain_profile.cfm?d=famundo.com)**
>
> Great domain names provide SEO, branding, and a memorable experience for your users. Get a premium domain today.

Bye,

Guy.

---

<div class="post-metadata">

**Author:** ![donsdgr81](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/b2d939/32.png) [@donsdgr81](https://www.ruby-forum.com/u/donsdgr81)\
**Post date:** [May 31, 2006, 10:33pm UTC](https://www.ruby-forum.com/t/restricting-access-to-files-uploaded-by-file-column/62078/7 "2006-05-31T22:33:35Z")

</div>

> Does anyone know how to restrict access on files that you upload in file  
> column to certain users only? I notice that files being saved by the  
> file\_column by default are being saved under the public folder and can  
> be accessed just by typing the URL directly. Let’s say you have a Login  
> system where you restrict access to some pages and allow those users to  
> upload their own files, I also want those files to be secured and only  
> allow users who uploaded those files to be able to access it.

In my branch of file\_column ([http://svn.kylemaxwell.com/file\_column/](http://svn.kylemaxwell.com/file_column/)),  
i use a salted SHA1 hash of the primary key for the image storage  
folder. It’s not truly secure, per se, but you can’t guess the file  
name.

–  
Kyle M.  
Chief Technologist  
E Factor Media // FN Interactive  
removed\_email\_address@domain.invalid  
1-866-263-3261