FileUpload Control question

[JoeP]

Hi All,

I am using the FileUpload control for the ASPX page. How do you disable the
text box portion of that control, so I can force the user only to pick up a
file via the Browser button, and not to type any file name that does not
exists.

Thanks,

Joe

[IfThenElse]

For security reason you can not force the user to what you want.

"JoeP" <Jo**@hotmail.c omwrote in message
news:ez******** ******@TK2MSFTN GP05.phx.gbl...

Hi All,

I am using the FileUpload control for the ASPX page. How do you disable
the text box portion of that control, so I can force the user only to pick
up a file via the Browser button, and not to type any file name that does
not exists.

Thanks,

Joe

[JoeP]

What kind of security issue are we talking here?

Is there any other way to validate that there is a real file out there?
Otherwise the user just can just type anything in that textbox.

Appreciate any feedback or any other suggestions.

Thanks,

Joe

[IfThenElse]

JoeP,
In ASP.NET 2.0 VS2005
if the user types a full filename that does not exist then your submit
button does not do anything.
if the user types a good filePath Name then at the server level you can
check the name etc.

The File Upload control does not give us the developers the capability to
dynamically change what file to upload.
There is a general security lock on what we can see and do on the client
side.

You can write an ActiveX, JAVAApplet or a SilverLight ( using C# or VB.NET
or others ) to have an upload file that can deal with what you want
including selecting and uploading multiple files at once with multiple
selects.
In this case the client is consenting to allow you to poke around.

"JoeP" <Jo**@hotmail.c omwrote in message
news:%2******** ********@TK2MSF TNGP02.phx.gbl. ..

What kind of security issue are we talking here?

Is there any other way to validate that there is a real file out there?
Otherwise the user just can just type anything in that textbox.

Appreciate any feedback or any other suggestions.

Thanks,

Joe

[JoeP]

OK if the submit does not do anything, is there away to trap that action and
have a message for the user? I have other fields and I can validate them
using RequiredFieldVa lidator, but that's done in the client side.

Thanks,

Joe

[IfThenElse]

good question,
even if you intercept the submit button event on the client side How would
you know if the file path is valid.

I don't have a good answer.

I hope someone else can give me and you an answer.

What file do you except and what files you don't except.

even if the name is correct and the extension is correct the file might not
have the correct content for the extension given.

Sometimes you just need to accept what can be done and move on.

I am still hoping for an answer myself.

"JoeP" <Jo**@hotmail.c omwrote in message
news:eO******** *****@TK2MSFTNG P06.phx.gbl...

OK if the submit does not do anything, is there away to trap that action
and have a message for the user? I have other fields and I can validate
them using RequiredFieldVa lidator, but that's done in the client side.

Thanks,

Joe

[JoeP]

Thanks for your reply.
I see your point. How would you limit the size of the file to 8MB?

Is that possible via the Web.Config?

[Juan T. Llibre]

re:
!Is that possible via the Web.Config?

In web.config...

<httpRuntime maxRequestLengt h="8192"/>

....will limit uploads to 8MB in size.

Juan T. Llibre, asp.net MVP
asp.net faq : http://asp.net.do/faq/
foros de asp.net, en español : http://asp.net.do/foros/
=============== =============== ========
"JoeP" <Jo**@hotmail.c omwrote in message news:ef******** ******@TK2MSFTN GP02.phx.gbl...

Thanks for your reply.
I see your point. How would you limit the size of the file to 8MB?

Is that possible via the Web.Config?

[IfThenElse]

In my case I changed it in my Machine.config
But I think if you put it in web.config then it overrides the one in
machine.

Stolen instruction from http://forums.asp.net/p/1048294/1948278.aspx

One of the great things about .NET, however, is that it usually provides a
way around limitations. You can usually change the default settings that are
in place. To change this size limit, you make some changes in either the
web.config.comm ents (found in the ASP.NET 2.0 configuration folder at
C:\WINDOWS\Micr osoft.NET\Frame work\v2.0.50727 \CONFIG) or your application's
web.config file.

In the web.config.comm ents file, find a node called <httpRuntimetha t looks
like the following:

<httpRuntime
executionTimeou t="110"
maxRequestLengt h="4096"
requestLengthDi skThreshold="80 "
useFullyQualifi edRedirectUrl=" false"
minFreeThreads= "8"
minLocalRequest FreeThreads="4"
appRequestQueue Limit="5000"
enableKernelOut putCache="true"
enableVersionHe ader="true"
requireRootedSa veAsPath="true"
enable="true"
shutdownTimeout ="90"
delayNotificati onTimeout="5"
waitChangeNotif ication="0"
maxWaitChangeNo tification="0"
enableHeaderChe cking="true"
sendCacheContro lHeader="true"
apartmentThread ing="false" />
A lot is going on in this single node, but the setting that takes care of
the size of the files to be uploaded is the maxRequestLengt h attribute. By
default, this is set to 4096 kilobytes (KB). Simply change this value to
increase the size of the files that you can upload to the server. If you
want to allow 10 megabyte (MB) files to be uploaded to the server, set the
maxRequestLengt h value to 11264, meaning that the application allows files
that are up to 11000 KB to be uploaded to the server.

Making this change in the web.config.comm ents file applies this setting to
all the applications that are on the server. If you want to apply this to
only the application you are working with, apply this node to the web.config
file of your application, overriding any setting that is in the
web.config.comm ents file. Make sure this node resides between the
<system.webnode s in the configuration file.

Another setting involved in the size limitation of files to be uploaded is
the value given to the executionTimeou t attribute in the <httpRuntimenod e.

The value given the executionTimeou t attribute is the number of seconds the
upload is allowed to occur before being shut down by ASP.NET. If you are
going to allow large files to be uploaded to the server, you are also going
to want to increase this value along with the maxRequestLengt h value.

One negative with increasing the size of a file that can be uploaded is that
there are hackers out there who attack servers by throwing a large number of
requests at them. To guard against this, you can actually decrease the size
of the files that are allowed to be uploaded; otherwise, you may find
hundreds or even thousands of 10 MB requests hitting your server.

"JoeP" <Jo**@hotmail.c omwrote in message
news:ef******** ******@TK2MSFTN GP02.phx.gbl...

Thanks for your reply.
I see your point. How would you limit the size of the file to 8MB?

Is that possible via the Web.Config?

[JoeP]

Thanks Juan.