How to download a file from rails application

Question

I can't seem to find a simple and clear answer to this problem anywhere! Everything seems either outdated or incomplete!

I just want the user to be able to click on a link or button and download a file (that is somewhere in the public folder)

I tried this:

#view
<%= link_to "Raw blast output" ,:action => :download, :file_name => "public/data/02_blastout/#{@bl_file}" %>
#controller
def download
    send_file "#{RAILS_ROOT}/#{params[:file_name]}"
end

but I get this error:

No route matches {:action=>"download", :file_name=>"public/data/02_blastout/input0.fa_x_Glyma1aaunq.bl", :controller=>"cvits"}

Thanks for the help!!

may be this ap.rubyonrails.org/classes/ActionController/Streaming.html ? — AndrewShmig
– AndrewShmig, Commented Jun 17, 2011 at 21:28
This seems like a terribly unsafe way to handle this, especially considering you can just link directly to the file. — Mario
– Mario, Commented Jun 17, 2011 at 21:29
@Andrew - use what? I am already using the send_file method. — bdeonovic
– bdeonovic, Commented Jun 17, 2011 at 21:29
Someone could edit your link like this: ?file_name=config/database.yml — Mario
– Mario, Commented Jun 17, 2011 at 21:31
send_file should never be given a path set by a param, this opens up a major security hole that malicious users will exploit. — Mario
– Mario, Commented Jun 17, 2011 at 21:36

Mario · Accepted Answer · 2011-06-17 21:38:40Z

40

Don't use send_file with a parameter set by a user. This opens up a massive security hole, allowing a user to access any file that is readable by your application (namely, your entire application, but also possibly other files on the filesystem).

Rather, if the file is under public, link to the file itself. In your case:

<%= link_to "Raw blast output", "/data/02_blastout/#{@bl_file}" %>

No need for a special controller action.

answered Jun 17, 2011 at 21:38

Mario

2,9421 gold badge27 silver badges38 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

Josh M. Over a year ago

Won't the download lockup the rails process? Shouldn't the download instead be handled by the http server (apache, etc.) as in: therailsway.com/2009/2/22/file-downloads-done-right

Mario Over a year ago

If you set up apache or another server, it should handle that. This is just the code for the link.

miguelfg Over a year ago

What if it is not a public file?, and it's only for registered user's?

Julien Lamarche Over a year ago

Mario makes a good point. But one could check if the file is within a specific directory that is expected to be a directory for downloadable content, or if the file is registered in a table of downloadable files. No?

Tun Over a year ago

web.archive.org/web/20160201222918/http://www.therailsway.com/… archived link mentioned by @JoshM.

Collectives™ on Stack Overflow

How to download a file from rails application

1 Answer 1

5 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

5 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related