def file_download
      if !model.edgarj_file?(params[:column])
        flash[:error] = t('edgarj_file.no_assoc')
        return
      end

      file_info_id = user_scoped.find(params[:id]).send(params[:column])
      if file_info_id
        file_info = FileInfo.find(file_info_id)
        if file_info
          send_file(file_info.full_filename, :filename => file_info.filename)
          return
        end
      end
      logger.warn 'invalid file_info'
    end
def file_download
      if !model.edgarj_file?(params[:column])
        flash[:error] = t('edgarj_file.no_assoc')
        return
      end

      file_info_id = user_scoped.find(params[:id]).send(params[:column])
      if file_info_id
        file_info = FileInfo.find(file_info_id)
        if file_info
          send_file(file_info.full_filename, :filename => file_info.filename)
          return
        end
      end
      logger.warn 'invalid file_info'
    end
To prevent unassociated file access, do:

 1. check if it is in model object
 1. check if it is a edgarj_file column

 === Permission
 ModelPermission::READ on this controller is required.