Rails application deployed on ubuntu server … How to securely access system files

Question

1. Rails application running on ubuntu 12.04 server
2. The server has multiple users who store files within their user accounts on the server
3. I would like to allow these users' files for download through the rails app

... Is there a secure way to do this?

Answer 1

Check out carrier wave , the most important issue here IMO is making sure your rails app is not running as a privileged user so the users can't pass creative paths that result in them getting to files you want to keep from them.

As for getting access to other user accounts, you would need to make sure the files are marked as readable by anyone or from a group that all users belong to.