Uploading files from IE

[AB]

All right... I already hated IE. But, now I do even more. My scripts
upload function is working in Firefox, but not in IE. If I upload a file
from Internet Explorer I get a file on the system named for the full path
from the users computer...

example...
They user uploads C:\mydocs\test. jpg
it ends up at /path/to/webdir/C:\mydocs\test. jpg
instead of /path/to/webdir/test.jpg

This only happens in IE. Firefox, Safari, Opera... all work fine.

This code is to show how I am going about getting the name... not the actual
code from my program.

upload_dir = "/path/to/webdir/"
myForm = cgi.FieldStorag e
ulImage = myForm["ulImage"]
myName = ulImage.filenam e
newFile = file (os.path.join(u pload_dir, myName), 'wb')
while 1:
chunk = ulImage.file.re ad(100000)
if not chunk: break
newFile.write(c hunk)
newFile.close()


Thanks for any help.
AG

[Irmen de Jong]

Re: Uploading files from IE

AB wrote:[color=blue]
> All right... I already hated IE. But, now I do even more. My scripts
> upload function is working in Firefox, but not in IE. If I upload a file
> from Internet Explorer I get a file on the system named for the full path
> from the users computer...
>
> example...
> They user uploads C:\mydocs\test. jpg
> it ends up at /path/to/webdir/C:\mydocs\test. jpg
> instead of /path/to/webdir/test.jpg[/color]

try something like this:
filename = os.path.basenam e(fullpathname)

--Irmen

[AB]

Re: Uploading files from IE


"Irmen de Jong" <irmen.NOSPAM@x s4all.nl> wrote in message
news:4421d24a$0 $11071$e4fe514c @news.xs4all.nl ...[color=blue]
> AB wrote:[color=green]
>> All right... I already hated IE. But, now I do even more. My scripts
>> upload function is working in Firefox, but not in IE. If I upload a file
>> from Internet Explorer I get a file on the system named for the full path
>> from the users computer...
>>
>> example...
>> They user uploads C:\mydocs\test. jpg
>> it ends up at /path/to/webdir/C:\mydocs\test. jpg
>> instead of /path/to/webdir/test.jpg[/color]
>
> try something like this:
> filename = os.path.basenam e(fullpathname)[/color]

I tried the following with the same result:
myName = ulImage.filenam e
newFile = file (os.path.join(u pload_dir, os.path.basenam e(myName)), 'wb')

Any other ideas? Seems like it shouldn't be a browser issue though...

[and-google@doxdesk.com]

Re: Uploading files from IE

AB wrote:
[color=blue]
> I tried the following with the same result:
> myName = ulImage.filenam e
> newFile = file (os.path.join(u pload_dir, os.path.basenam e(myName)), 'wb')[/color]

os.path is different on your system to the uploader's system. You are
using Unix pathnames, with a '/' separator - they are using Windows
ones, with '\', so os.path.basenam e won't recognise them as separators.
Old-school-Macintosh and RISC OS machines have different path
separators again.

The Content-Disposition filename parameter can be set by the user-agent
to *anything at all*. Using it without some serious sanitising
beforehand is a recipe for security holes. In your original code an
attacker could have arbitrarily written to any file the web user had
access to. The code with os.path.basenam e is better but could still be
confused by things like an empty string, '.', '..' or invalid
characters.

It's best not to use any user-submitted data as the basis for
filenames. If you absolutely *must* use Content-Disposition as a local
filename you must send it through some strict checking first, whether
the browser sends full paths to you or not.

--
And Clover
mailto:and@doxd esk.com

http://www.doxdesk.com/