sendfile.php

<?php


public function actionFile($filename)
{
     $storagePath = Yii::getAlias('@app/files');

   // check filename for allowed chars (do not allow ../ to not allow listing)
   if (!preg_match('/^[a-z0-9]+\.[a-z0-9]+$/i', $filename) || !is_file("$storagePath/$filename")) {
       throw new NotFoundHttpException('The file does not exists.');
   }
   return Yii::$app->response->sendFile("$storagePath/$filename", $filename);
}