move shrine files out of public. use x-sendfile to send files for security.

app/models/ability.rb

@@ -4,7 +4,6 @@ class Ability
   include CanCan::Ability
 
   def initialize(user)
-
     # Define abilities for the passed in user here. For example:
     #
     #   user ||= User.new # guest user (not logged in)
@@ -33,29 +32,29 @@ class Ability
     # https://github.com/CanCanCommunity/cancancan/wiki/Defining-Abilities
 
     # Everybody can see public screenshots
-    can :view, Screenshot, approved: true, hidden:false
+    can :view, Screenshot, approved: true, hidden: false
 
-    if user.present? # Logged-in users
-      # Allow to view own uploads (even not-yet-approved)
-      can :view, Screenshot, user_id: user.id
-      can :destroy, Screenshot, user_id: user.id
+    return unless user.present? # Logged-in users
 
-      if user.admin_role?
-        can :approve, Screenshot
-        can :destroy, Screenshot
-        can :hide, Screenshot
-        can :unhide, Screenshot
-        can :destroy, User
-        can :view, Screenshot
-        can :destroy, Package
-        can :view, Log
-      end
-      if user.moderator_role?
-        can :approve, Screenshot
-        can :hide, Screenshot
-        can :unhide, Screenshot
-        can :view, Screenshot
-      end
+    # Allow to view own uploads (even not-yet-approved)
+    can :view, Screenshot, user_id: user.id
+    can :destroy, Screenshot, user_id: user.id
+
+    if user.admin_role?
+      can :approve, Screenshot
+      can :destroy, Screenshot
+      can :hide, Screenshot
+      can :unhide, Screenshot
+      can :destroy, User
+      can :view, Screenshot
+      can :destroy, Package
+      can :view, Log
     end
+    return unless user.moderator_role?
+
+    can :approve, Screenshot
+    can :hide, Screenshot
+    can :unhide, Screenshot
+    can :view, Screenshot
   end
 end