How to make an assets folder private in rails?

Question

I'm using Paperclip for letting users upload photos to my app. Then, I'm saving the photos in /public/photos. Now, I want the photos being accessible just for some users. How can I set this permission system up?

Answer 1

First, I would recommend not saving your photos to your public folder, but rather some other folder even outside of your app directory.

Second, you can attribute your Photo model to belong_to 'some' users. Not sure what 'some' is in your description. But from then, you can in your controller, only pull photos from the Photo model that your current_user should see.

Answer 2

Definitely move the photos out of public/, then you can use send_file in a controller action to display the photos instead.

I briefly skimmed over this blog post, it looked pretty good:
http://harrylove.org/2008/12/22/protected-file-downloads-with-ruby-on-rails-and-paperclip.html