Rails%203%20In%20Action

230 CHAPTER 9 File uploading
When you rerun your specs, they both pass because the authorized user (good_user)
can get a file and the unauthorized user (bad_user) can’t:
2 examples, 0 failures
Great! Now you’ve begun to serve the files from FilesController to only people who
have access to the asset’s relative projects. There’s one problem, though: all users can
still access these files without having to go through the FilesController.
9.3.3 Public assets
People can still get to your files as long as they have the
link provided to them because the files are still stored
in the public folder. Let’s see how this is possible by
starting up the server using rails server, signing in,
and creating a ticket. Upload the spec/fixtures/spin.txt
file as the only file attached to this ticket. You should
see a ticket like the one in figure 9.2.
Hover over the spin.txt link on this page, and
you’ll see a link like this:
http://localhost:3000/system/assets/5/original/spin.txt?1282564953
As you saw earlier in this chapter, this link is a route not to a controller in your application
but to a file inside the public directory. Any file in the public directory is accessible
to the public. Sensible naming schemes rock!
If you copy the link to this file, sign out, and then paste the link into your browser
window, you can still access it. These files need to be protected, and you can do that by
moving them out of the public directory and into another directory at the root of your
application called files. You should create this directory now.
9.3.4 Privatizing assets
Figure 9.2 A ticket with spin!
You can make these files private by storing them in the files folder. You don’t have to
move them there manually: you can tell Paperclip to put them there by default by
passing the :path option to has_attached_file in app/models/asset.rb like this:
has_attached_file :asset, :path => (Rails.root + "files/:id").to_s
Now try creating another ticket and attaching the spec/fixtures/spin.txt file. This time
when you use the link to access the file, you’re told there’s no route. This is shown in
figure 9.3.
Figure 9.3 No route!