Allow users to download a file

Question

I've read through a number of StackOverflow threads and tutorials, and I haven't found a good, simple explanation for how to allow a user to download a file from your site.

All I want to do is add a link to one of my views which downloads a file when clicked.

I'd like to understand:

• Where do I store the downloadable file in my file system? public?
• Is there anything special about linking to the file in your view, or it's just a link_to?
• What needs to happen in routes? It's just a get for that controller#action?
• What needs to happen in the controller? In rails documentation I've read that you need to "be careful to sanitize the path parameter if it is coming from a web page," but I'm not sure exactly what that means.

Thanks!

Answer 1

There are basically two cases:

1. The file is public and should be downloadable by anyone.

Place it in the /public directory. Remember that this is the web root - so if you have a file that lives at /public/foo/bar.baz you would link to the file with <%= link_to 'A file', '/foo/bar.baz' %>.

No routes or controllers are need since we are just serving a static file from the servers public directory.

2. The file needs access control

In this example we are dynamically servering files stored in /downloads.

# routes.rb
resources :downloads, only: [:show]

class DownloadsController < ApplicationController
  # do your authentication logic here

  # GET /downloads/:id
  # @example
  #  GET /downloads/foo.bar would download a file stored at
  #  /downloads/foo.bar
  # @raise [ActiveRecord::RecordNotFound] if the file does not exist.
  #   This causes a 404 page to be rendered.
  def show
    fn = Rails.root.join('downloads', params[:id])
    raise ActiveRecord::RecordNotFound and return unless file.exists?(fn) 
    send_file(fn)
  end
end

By using Rails to serve the download we can apply whatever access control rules we want.

Answer 2

In simple scenario, you don't need controller to download file. Just save file to public folder. Public folder is default folder for static resources there are stored compiled js, css, images files, robot.txt and so on.

If you have file monthly-report.doc. Put it to public/reports/monthly-report.doc.

In view link_to 'Donwload Report', '/reports/monthly-report.doc'

Answer 3

The link_to is the same as any other link.

If you want to store it in public then do this in whatever controller action you want.

send_file File.join(Rails.root, 'public', 'file.extension')

You could create a downloads controller and specify that in the index then simply link_to 'Download', download_index_path or such.

If you're trying to send a file name that a user inputs, you have to sanitize it. If it's "hard coded" like the above example, then you're fine.