You are here: Re: how to show "browse for folder" dialog in html/javascript? « HTML « IT news, forums, messages
Re: how to show "browse for folder" dialog in html/javascript?

Posted by Jonathan N. Little on 10/02/05 20:52

Randy Webb wrote:
<snip>
>
> You can not programattically set the value of an input type="file" using
> Javascript. You can read it's value, but, you can not set it's value.
> And in order to upload, you have to set it's value.
>

Not trying to be argumentative, just trying understand here, agreed you
cannot set the input type="file" programattically, but you can use said
input to collect the list of local files for upload, right? That's what
my little demo does. Next that list can be sent via form field (not
type="file"), right?


>>
>>>> I would think you would need more JavaScript to enter list/array
>>>> into a form input that would be passed to some server-side script to
>>>> do the actual uploading...
>>>
>>>
>>>
>>>
>>> If what you are describing is possible in javascript, then anybody
>>> could simply set the value of a hidden field to whatever file they
>>> wanted off your PC and upload it automatically. That is not allowed
>>> (and what you are describing) for that very reason. File inputs are
>>> very limited in javascript context for a reason - security.
>>>
>>
>> Now JavaScript cannot be used to upload files, but the list sent to a
>> server-side script could use the list a as a queue, right?
>
>
> It would still take user interaction. But, if you set the file name
> server-side and send the page back to the browser, it will not have the
> file set in the type="file" input. Try it :)
>

I did not say without user interaction, and I did not say that the file
list or that form initiate the file upload, just send the list.

> Think about the implications if you could set it:
>
> <form name="myForm">
> <div style="display:none">
> <input type="file" value="Whateverfileyouwantontheserver">
> </div>
>
> <input type="text" name="usersName">
>
> ... more legitimate inputs ....
>
> </form>

Yes this would be wildly dangerous!!!!
>
> When the user submitted the form, you could get what ever file you
> wanted off the users computer. That is a very huge security risk and
> because of it, you can not set the value of a file input.
>


I'm just saying the form could send the file list data then the
receiving CGI on the server can make the fit connection and upload the
files. It's this how those cookie-cutter server-side site building apps
lik work, or webmail form's attachment routines work?


--
Take care,

Jonathan
-------------------
LITTLE WORKS STUDIO
http://www.LittleWorksStudio.com

 

Navigation:

[Reply to this message]


Удаленная работа для программистов  •  Как заработать на Google AdSense  •  England, UK  •  статьи на английском  •  PHP MySQL CMS Apache Oscommerce  •  Online Business Knowledge Base  •  DVD MP3 AVI MP4 players codecs conversion help
Home  •  Search  •  Site Map  •  Set as Homepage  •  Add to Favourites

Copyright © 2005-2006 Powered by Custom PHP Programming

Сайт изготовлен в Студии Валентина Петручека
изготовление и поддержка веб-сайтов, разработка программного обеспечения, поисковая оптимизация