added new stuff for thank you and security

app/controllers/admin/asks_controller.rb

@@ -221,7 +221,7 @@ class Admin::AsksController < OrbitAdminController
   def get_category_setting_field
     @default_ask_setting = AskSetting.first
     ask_setting = AskCategorySetting.find(params['id'])
-    render partial: 'category_setting_field',locals: {ask_setting: ask_setting} 
+    render partial: 'category_setting_field',locals: {ask_setting: ask_setting}
   end
   def category_print_setting_delete
     print_setting = AskCategoryPrintSetting.find(params['id'])
@@ -378,7 +378,7 @@ class Admin::AsksController < OrbitAdminController
       if !file.blank?
         if v['type']=='image'
           all_to_save += [[k,AskImage.new(file: file,ask_question_id: @ask_question.id)]]
-        else 
+        else
           all_to_save += [[k,AskFile.new(file: file,ask_question_id: @ask_question.id)]]
         end
       else
@@ -608,12 +608,40 @@ class Admin::AsksController < OrbitAdminController
     end
     render :json => {:success=>true}
   end
+
+  def download_file
+		ask_status_id = params[:ask_status_id]
+		obj = AskStatusHistory.find(ask_status_id) rescue nil
+    if obj.nil?
+      obj = AskFile.find(ask_status_id) rescue nil
+    end
+		if !obj.nil? && obj.file.present?
+			@url = obj.file.url
+			begin
+				@path = obj.file.file.file rescue ""
+				@filename = File.basename(@path)
+				@ext = @filename.split(".").last
+        if (current_site.accessibility_mode rescue false)
+          render "redirect_to_file",:layout=>false
+        else
+          user_agent = request.user_agent.downcase
+          @escaped_file_name = user_agent.match(/(msie|trident)/) ? CGI::escape(@filename) : @filename
+          send_file(@path, :type=>"application/octet-stream", :filename => @escaped_file_name, :x_sendfile=> true)
+        end
+			rescue
+				redirect_to @url
+			end
+		else
+			render :file => "#{Rails.root}/app/views/errors/404.html", :layout => false, :status => :not_found
+		end
+	end
+
   private
     def ask_setting_params(ask_setting,collection_name, except_customs=[])
       param = params.require(collection_name).except("id").permit!
       param_clone = param.clone
       param_clone['default_setting'].each { |k, v| param_clone['default_setting'][k] = (v == 'true'? true : false) if param_clone['default_setting'][k].class==String}
-      param_clone['default_setting_required'].each { |k, v| param_clone['default_setting_required'][k] = (v == 'true'? true : false) if param_clone['default_setting_required'][k].class==String} 
+      param_clone['default_setting_required'].each { |k, v| param_clone['default_setting_required'][k] = (v == 'true'? true : false) if param_clone['default_setting_required'][k].class==String}
       param_clone.delete('custom_fields')
       param_clone.delete('email_regex') unless collection_name == 'ask_setting'
       ask_setting.custom_fields_will_change!