Question

Here is the situation.

I have an action method, which returns a file, called “GetDocument” in “Documents” controller. It has one parameter of type Document, which contains document path, title, type etc.

I have a View for an entity, which has some documents attached with it. For example, a news story, with attached documents. On this view I show various links for the documents which the end user should be able to download.

The question is: How do I create such links which pass proper “Document” object to the “GetDocument” Action Method?

Edit: I do not want to show full path of the document to the user. In fact, I would like that I store documents in App_Data folder, so that they cannot be downloaded otherwise.

Thanks!

Answer 1

You could use an ActionLink:

@Html.ActionLink(
    "Download", 
    "GetDocument", 
    new {
        path = "report.pdf",
        type = "application/pdf"
    }
)

and then:

public ActionResult GetDocument(Document doc)
{
    var appData = Server.MapPath("~/App_Data");
    var file = Path.Combine(appData, doc.Path);
    file = Path.GetFullPath(file);
    if (!file.StartsWith(appData))
    {
        // Ensure there are no cheaters trying to read files
        // outside of the App_Data folder like "../web.config"
        throw new HttpException(403, "Forbidden");
    }
    if (!File.Exists(file))
    {
        return HttpNotFound();
    }
    return File(file, doc.Type, Path.GetFileName(file));
}