Prevent a Paste of a Filename in an Input Type=File

[Larry Bud]

I rarely crosspost, but this affects both ASP and Javascript

REALLY odd bug that I ran across in ASP 3.0. I have an input type of
file, user clicks browse, then places his cursor in the filename, puts
a space at the end of the file, and uploads it. Web server doesn't
translate the MIME type of document properly because it doesn't end
with a valid extension, yet the file itself uploads successfully. I'm
using SAFileUP for my uploading component.

So I now return a FALSE in an ONKEYPRESS event, which prevents the
user from entering a space at the end of the file (why he does this is
beyond me, but I'm trying to idiot proof this thing).

Problem is, the ONKEYPRESS doesn't prevent a Paste of a string into
the field, so it's still technically possible to munge the filename.
Blurring the control on a focus or setting it to disabled doesn't work
because it makes the Browse button unfunctional.

Platform: i.e.6.

Any ideas?

[Evertjan.]

pcx99 wrote on 09 feb 2007 in microsoft.publi c.inetserver.as p.general:

[Please do not toppost on usenet]

Clientside javascript has no problems reading the contents of an input
of type file. It will crash your script with a security error if you
attempt to use javascript to change the contents though. The newer
browsers will show only the file name and not the full path (IE7
notably), perhaps the path filters threw out your input as invalid
before the display. Regardless...

<form>
<input type="file" id="ff">
</form>

<button onClick="alert( document.getEle mentById('ff'). value)">Click Me
to read</button>
Will quite merrily show you the contents of the input field provided
there is actually something there.

You are right, I did a test that showed otherwise,
[by specifying value='qwerty', but that is in itself faulty]

And Bob is quite right, I should have specified type=file, however it
really didn't occur to me that given the question it would actually
need to be stated.

No, my argument was about the "read only", not the specification per se.

Sometimes the lawyerball in these forums can be quite
maddening.

'lawyerball' what is that? If you want to say something please do not
use local slang.

--
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)

[pcx99]

Evertjan. wrote:

pcx99 wrote on 09 feb 2007 in microsoft.publi c.inetserver.as p.general:

[Please do not toppost on usenet]

That is a definition of lawyerball.

'lawyerball' what is that? If you want to say something please do not
use local slang.

As is this.

Consider it thus: Quibbling over inconsequential semantics and requiring
every last word to be strictly, legally defined to accommodate anal
retentive people who are unable to read things in context.

--
http://www.hunlock.com -- Musings in Javascript, CSS.
$FA

[Evertjan.]

pcx99 wrote on 09 feb 2007 in microsoft.publi c.inetserver.as p.general:

Evertjan. wrote:

>pcx99 wrote on 09 feb 2007 in microsoft.publi c.inetserver.as p.general:

[Please do not toppost on usenet]

That is a definition of lawyerball.

You don't even seem to know the definition of definition.

>'lawyerball' what is that? If you want to say something please do not
use local slang.

As is this.

Consider it thus: Quibbling over inconsequential semantics and requiring
every last word to be strictly, legally defined to accommodate anal
retentive people who are unable to read things in context.

If you are happy arguing about that, so be it.
You must be new on usenet,
expecting to make your own netiquette and
disregarding that these are two international NGs.

--
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)

[Anthony Jones]

"Evertjan." <ex************ **@interxnl.net wrote in message
news:Xn******** ************@19 4.109.133.242.. .

pcx99 wrote on 09 feb 2007 in microsoft.publi c.inetserver.as p.general:

Evertjan. wrote:

pcx99 wrote on 09 feb 2007 in microsoft.publi c.inetserver.as p.general:

[Please do not toppost on usenet]

That is a definition of lawyerball.

You don't even seem to know the definition of definition.

'lawyerball' what is that? If you want to say something please do not
use local slang.

As is this.

Consider it thus: Quibbling over inconsequential semantics and requiring
every last word to be strictly, legally defined to accommodate anal
retentive people who are unable to read things in context.

If you are happy arguing about that, so be it.
You must be new on usenet,

Yeah those us who have been around these news groups have just given up
arguing with you about it ;)

[Dave Anderson]

pcx99 wrote:

The newer browsers will show only the file name and not the
full path (IE7 notably), perhaps the path filters threw out
your input as invalid before the display.

For what it's worth, IE7 still sends the full path with the form submission,
regardless of what it displays.


--
Dave Anderson

Unsolicited commercial email will be read at a cost of $500 per message. Use
of this email address implies consent to these terms.

[pcx99]

Dave Anderson wrote:

pcx99 wrote:

>The newer browsers will show only the file name and not the
full path (IE7 notably), perhaps the path filters threw out
your input as invalid before the display.

For what it's worth, IE7 still sends the full path with the form submission,
regardless of what it displays.

Yea that is hilariously funny, they go to extreme lengths (and break
many existing apps) to mask the full path in the browser and then send
the full path to the server. This ranks right up there with them
breaking the prompt command.

--
http://www.hunlock.com -- Musings in Javascript, CSS.
$FA