使用carrierwave gem rails4 安全上传/下载文件答案

【问题标题】：secure upload/download file with carrierwave gem rails4使用carrierwave gem rails4 安全上传/下载文件
【发布时间】：2014-09-04 07:35:25
【问题描述】：

认证用户可以下载和上传文件，这是我项目的主要目的。我想保护我的文件下载，这样只有认证用户才能下载文件。为此，我使用 gem carrierwave 和 carrierwave/wiki "How To: Secure Upload" 。但是当我点击我的下载网址时，它会显示“HTTP/1.1 500 Internal Server Error”

这里是 addfiles_controller.rb 文件：

class AddfilesController < ApplicationController
  before_action :logged_in

  def index
    @addfiles = Addfile.all
  end

  def new
    @addfile = Addfile.new
  end

  def create
    if admin_signed_in?
      @addfile = current_admin.addfiles.build(addfile_params)
    else
      @addfile = current_user.addfiles.build(addfile_params)
    end


    if @addfile.save
      redirect_to addfiles_path
    else
      render "new"
    end
  end

  def destroy
    @addfile = Addfile.find(params[:id])
    @addfile.destroy
    redirect_to addfiles_path
  end


  def download
    path = "/#{addfile.addfile}"
    send_file path, :x_sendfile=>true
  end



  private
  def addfile_params
    params.require(:addfile).permit(:name, :attachment)
  end
end

config/initializers/carrierwave.rb 文件：

CarrierWave.configure do |config|
  # These permissions will make dir and files available only to the user running
  # the servers
  config.permissions = 0600
  config.directory_permissions = 0700
  config.storage = :file
  # This avoids uploaded files from saving to public/ and so
  # they will not be available for public (non-authenticated) downloading
  config.root = Rails.root
end

routes.rb 文件：

FileDownload::Application.routes.draw do

  match "/uploads/:id/:basename.:extension", :controller => "addfiles", :action => "download", via: :get

  resources :addfiles do
    collection  do
      get 'all_users'
    end
  end
  root "addfiles#index"
  devise_for :admins
  devise_for :users

end

在我看来：

<%= link_to File.basename(file.attachment_url), "/uploads/#{file.id}/#{File.basename(file.attachment_url)}" %>

attachment_uploader.rb 文件

class AttachmentUploader < CarrierWave::Uploader::Base

  storage :file

  def store_dir
    "uploads/#{model.class.to_s.underscore}/#{mounted_as}/#{model.id}"
  end

  def extension_white_list
    %w(pdf doc htm html docx)
  end

end

错误追踪::

Started GET "/uploads/13/ARTICLE_FINAL_.pdf" for 127.0.0.1 at 2014-09-04 14:39:53 +0600
Processing by AddfilesController#download as */*
  Parameters: {"id"=>"13", "basename"=>"ARTICLE_FINAL_", "extension"=>"pdf"}
  ←[1m←[36mUser Load (0.0ms)←[0m  ←[1mSELECT "users".* FROM "users" WHERE "users"."id" = 1 ORDER BY "users"."id" ASC LIMIT 1←[0m
Completed 500 Internal Server Error in 4ms

NameError (undefined local variable or method `addfile' for #<AddfilesController:0x46baa10>):
  app/controllers/addfiles_controller.rb:37:in `download'


  Rendered C:/RailsInstaller/Ruby1.9.3/lib/ruby/gems/1.9.1/gems/actionpack-4.0.4/lib/action_dispatch/middleware/templates/rescues/_source.erb (0.0ms)
  Rendered C:/RailsInstaller/Ruby1.9.3/lib/ruby/gems/1.9.1/gems/actionpack-4.0.4/lib/action_dispatch/middleware/templates/rescues/_trace.erb (1.0ms)
  Rendered C:/RailsInstaller/Ruby1.9.3/lib/ruby/gems/1.9.1/gems/actionpack-4.0.4/lib/action_dispatch/middleware/templates/rescues/_request_and_response.erb (1.0ms)
  Rendered C:/RailsInstaller/Ruby1.9.3/lib/ruby/gems/1.9.1/gems/actionpack-4.0.4/lib/action_dispatch/middleware/templates/rescues/diagnostics.erb within rescues/layout (47.0ms)
[2014-09-04 14:39:53] ERROR Errno::ECONNRESET: An existing connection was forcibly closed by the remote host.
        C:/RailsInstaller/Ruby1.9.3/lib/ruby/1.9.1/webrick/httpserver.rb:80:in `eof?'
        C:/RailsInstaller/Ruby1.9.3/lib/ruby/1.9.1/webrick/httpserver.rb:80:in `run'
        C:/RailsInstaller/Ruby1.9.3/lib/ruby/1.9.1/webrick/server.rb:191:in `block in start_thread'

这里有什么问题？？请给我你的建议。

【问题讨论】：

请在此处粘贴您的错误跟踪。
@anusha，我添加了错误跟踪。
检查你的下载方法，在那里你指定path = "/#{addfile.addfile}"，但你的模型没有像addfile这样的任何字段（属性）（我检查了允许的参数）。
请在此处粘贴您的上传文件内容
尝试把这行path = "/#{addfile.addfile}"改成path = "/#{attachment.attachment}"

标签： ruby-on-rails ruby ruby-on-rails-4 carrierwave

【解决方案1】：

尝试像这样改变下载方式：

addfiles_controller.rb：

def download
      send_file '#{Rails.root}/uploads/addfile/#{file.id}'
end

【讨论】：

【解决方案2】：

我能够让它工作，类似于您设置的相同方式并遵循Carrerwave Wiki。

我也在使用 Pundit，所以在上下文中有一些授权。

class RecordsController < ApplicationController

  before_action :set_record, only: :download

  def download
    authorize @record
    send_file @record.file.path 
    #where file is the name of the mount_uploader from the Record class
  end

  private

    def set_record 
      @record = Record.find(params[:id]) 
    end 
end

【讨论】：