Enforce file access permissions

ram/ram/urls.py

@@ -21,17 +21,22 @@ from django.conf.urls.static import static
 from django.contrib import admin
 from django.urls import include, path
 
-from ram.views import UploadImage
+from ram.views import UploadImage, DownloadFile
 from portal.views import Render404
 
 handler404 = Render404.as_view()
 
 urlpatterns = [
     path("", lambda r: redirect("portal/")),
+    path("admin/", admin.site.urls),
     path("tinymce/", include("tinymce.urls")),
     path("tinymce/upload_image", UploadImage.as_view(), name="upload_image"),
+    path(
+        "media/files/<path:filename>",
+        DownloadFile.as_view(),
+        name="download_file",
+    ),
     path("portal/", include("portal.urls")),
-    path("admin/", admin.site.urls),
 ] + static(settings.MEDIA_URL, document_root=settings.MEDIA_ROOT)
 
 # Enable the "/dcc" routing only if the "driver" app is active
@@ -55,6 +60,7 @@ if settings.DEBUG:
     if settings.REST_ENABLED:
         from django.views.generic import TemplateView
         from rest_framework.schemas import get_schema_view
+
         urlpatterns += [
             path(
                 "swagger/",