instiki/app/controllers/file_controller.rb

require 'fileutils'
require 'application'
require 'instiki_errors'

class FileController < ApplicationController

  layout 'default'

  def file
    if @params['file']
      # received a file
      File.open(file_name) { |f| f.write(@params['file'].read }
      
    elsif have_file?
      send_file(file_path)
    else
      logger.debug("File not found: #{file_path}")
      # go to the template, which is a file upload form
    end
  end

  def cancel_upload
    return_to_last_remembered
  end
  
  def 
  
  private

  def have_file?
    sanitize_file_name
    File.file?(file_path)
  end

  SANE_FILE_NAME = /[-_A-Za-z0-9]{1,255}/

  def sanitize_file_name
    raise Instiki::ValidationError.new("Invalid path: no file name") unless @file_name
    unless @file_name =~ SANE_FILE_NAME
      raise ValidationError.new("Invalid file name: '#{@file_name}'.\n" +
            "Only latin characters, digits, underscores and dashes are accepted.")
    end
  end

  def file_area
    raise Instiki::ValidationError.new("Invalid path: no web name") unless @web_name
    file_area = File.expand_path("#{@wiki.storage_path}/#{@web_name}")
    FileUtils.mkdir_p(file_area) unless File.directory?(file_area)
    file_area
  end

  def file_path
    "#{file_area}/#{@file_name}"
  end

end