in reply to Re: Error ftping file with Net::FTP
in thread Error ftping file with Net::FTP

I don't see where you are extracting the base filename out of the fully-qualified filename likely being sent by the form.

Well, any SANE browser just sends the base filename and extension of the local file. MSIE, on the other hand, DOES send a fully qualified name, for no reason. So it looks like code never tested with a broken browser.

Alexander

--
Today I will gladly share my knowledge and experience, for there are no sweeter words than "I told you so". ;-)

Replies are listed 'Best First'.
Re^3: Error ftping file with Net::FTP
by Anonymous Monk on Aug 16, 2017 at 22:06 UTC
    firefox also sends the full filename
[reply]
      firefox also sends the full filename

      No, it doesn't. If you know better, name Firefox version and OS that does send the full path.

      To demonstrate:

      Put this as file-upload-test in a /cgi-bin/ folder and make it executable:

      #!/usr/bin/perl

use strict;
use warnings;

use CGI qw( -no_xhtml -nosticky );
use Data::Dumper ();

my $cgi=CGI->new();
my $f=$cgi->upload('f');
my $text=Data::Dumper->new([$cgi,\%ENV],['cgi','*ENV'])->Useqq(1)->Sor
+tkeys(1)->Indent(1)->Quotekeys(0)->Dump();
print
        $cgi->header(
                -type=>'text/html'
        ),
        $cgi->start_html(
                -title=>'CGI Dump',
        ),
        $cgi->start_multipart_form(),
        $cgi->filefield(-name => 'f'),
        $cgi->submit(),
        $cgi->end_form(),
        $cgi->pre($text),
        $cgi->end_html();

      [download]

      Result of uploading C:\Windows\notepad.exe using FF 54.0, 32 bit, Windows:

      $cgi = bless( {
  ".charset" => "ISO-8859-1",
  ".fieldnames" => {},
  ".parameters" => [
    "f"
  ],
  ".tmpfiles" => {
    "*File::Temp::\$fhnotepad.exe" => {
      hndl => bless( \*{'File::Temp::$fh'}, 'CGI::File::Temp' ),
      info => {
        "Content-Disposition" => "form-data; name=\"f\"; filename=\"no
+tepad.exe\"",
        "Content-Type" => "application/x-msdownload"
      },
      name => "/tmp/lteASdfRPK"
    }
  },
  escape => 1,
  param => {
    f => [
      $cgi->{".tmpfiles"}{"*File::Temp::\$fhnotepad.exe"}{hndl}
    ]
  },
  use_tempfile => 1
}, 'CGI' );
%ENV = (
  CONTENT_LENGTH => 193222,
  CONTENT_TYPE => "multipart/form-data; boundary=---------------------
+------232441531115",
  CONTEXT_DOCUMENT_ROOT => "/data/apache/cgi-bin/",
  CONTEXT_PREFIX => "/cgi-bin/",
  DOCUMENT_ROOT => "/data/apache/htdocs",
  GATEWAY_INTERFACE => "CGI/1.1",
  HTTP_ACCEPT => "text/html,application/xhtml+xml,application/xml;q=0.
+9,*/*;q=0.8",
  HTTP_ACCEPT_ENCODING => "gzip, deflate",
  HTTP_ACCEPT_LANGUAGE => "en-US,en;q=0.5",
  HTTP_CONNECTION => "keep-alive",
  HTTP_HOST => "localhost",
  HTTP_REFERER => "http://localhost/cgi-bin/file-upload-test",
  HTTP_UPGRADE_INSECURE_REQUESTS => 1,
  HTTP_USER_AGENT => "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:54.0) Gec
+ko/20100101 Firefox/54.0",
  LD_LIBRARY_PATH => "/usr/lib64/httpd",
  PATH => "/sbin:/usr/sbin:/bin:/usr/bin",
  QUERY_STRING => "",
  REMOTE_ADDR => "192.168.2.140",
  REMOTE_PORT => 49391,
  REQUEST_METHOD => "POST",
  REQUEST_SCHEME => "http",
  REQUEST_URI => "/cgi-bin/file-upload-test",
  SCRIPT_FILENAME => "/data/apache/cgi-bin/file-upload-test",
  SCRIPT_NAME => "/cgi-bin/file-upload-test",
  SERVER_ADDR => "192.168.2.10",
  SERVER_ADMIN => "me\@localhost",
  SERVER_NAME => "localhost",
  SERVER_PORT => 80,
  SERVER_PROTOCOL => "HTTP/1.1",
  SERVER_SIGNATURE => "",
  SERVER_SOFTWARE => "Apache"
);

      [download]

      No trace of C:\Windows\ in the output, because it was not sent by Firefox!

      Result of uploading /bin/false using FF ESR 52.3.0, 64 bit, Linux:

      $cgi = bless( {
  ".charset" => "ISO-8859-1",
  ".fieldnames" => {},
  ".parameters" => [
    "f"
  ],
  ".tmpfiles" => {
    "*File::Temp::\$fhfalse" => {
      hndl => bless( \*{'File::Temp::$fh'}, 'CGI::File::Temp' ),
      info => {
        "Content-Disposition" => "form-data; name=\"f\"; filename=\"fa
+lse\"",
        "Content-Type" => "application/octet-stream"
      },
      name => "/tmp/KTh3vytRsd"
    }
  },
  escape => 1,
  param => {
    f => [
      $cgi->{".tmpfiles"}{"*File::Temp::\$fhfalse"}{hndl}
    ]
  },
  use_tempfile => 1
}, 'CGI' );
%ENV = (
  CONTENT_LENGTH => 27458,
  CONTENT_TYPE => "multipart/form-data; boundary=---------------------
+------18269427081793764907232401438",
  CONTEXT_DOCUMENT_ROOT => "/data/apache/cgi-bin/",
  CONTEXT_PREFIX => "/cgi-bin/",
  DOCUMENT_ROOT => "/data/apache/htdocs",
  GATEWAY_INTERFACE => "CGI/1.1",
  HTTP_ACCEPT => "text/html,application/xhtml+xml,application/xml;q=0.
+9,*/*;q=0.8",
  HTTP_ACCEPT_ENCODING => "gzip, deflate",
  HTTP_ACCEPT_LANGUAGE => "en-US,en;q=0.5",
  HTTP_CONNECTION => "keep-alive",
  HTTP_HOST => "localhost",
  HTTP_REFERER => "http://localhost/cgi-bin/file-upload-test",
  HTTP_USER_AGENT => "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/2
+0100101 Firefox/52.0",
  LD_LIBRARY_PATH => "/usr/lib64/httpd",
  PATH => "/sbin:/usr/sbin:/bin:/usr/bin",
  QUERY_STRING => "",
  REMOTE_ADDR => "192.168.2.10",
  REMOTE_PORT => 60266,
  REQUEST_METHOD => "POST",
  REQUEST_SCHEME => "http",
  REQUEST_URI => "/cgi-bin/file-upload-test",
  SCRIPT_FILENAME => "/data/apache/cgi-bin/file-upload-test",
  SCRIPT_NAME => "/cgi-bin/file-upload-test",
  SERVER_ADDR => "192.168.2.10",
  SERVER_ADMIN => "me\@localhost",
  SERVER_NAME => "localhost",
  SERVER_PORT => 80,
  SERVER_PROTOCOL => "HTTP/1.1",
  SERVER_SIGNATURE => "",
  SERVER_SOFTWARE => "Apache"
);

      [download]

      No trace of /bin/ in the output, because it was not sent by Firefox!

      To compare: Result of uploading c:\WINNT\notepad.exe, with Internet Explorer 6.0, Windows 2000:

      $cgi = bless( {
  ".charset" => "ISO-8859-1",
  ".fieldnames" => {},
  ".parameters" => [
    "f"
  ],
  ".tmpfiles" => {
    "*File::Temp::\$fhc:\\WINNT\\NOTEPAD.EXE" => {
      hndl => bless( \*{'File::Temp::$fh'}, 'CGI::File::Temp' ),
      info => {
        "Content-Disposition" => "form-data; name=\"f\"; filename=\"c:
+\\WINNT\\NOTEPAD.EXE\"",
        "Content-Type" => "application/octet-stream"
      },
      name => "/tmp/n93zfrd2Bf"
    }
  },
  escape => 1,
  param => {
    f => [
      $cgi->{".tmpfiles"}{"*File::Temp::\$fhc:\\WINNT\\NOTEPAD.EXE"}{h
+ndl}
    ]
  },
  use_tempfile => 1
}, 'CGI' );
%ENV = (
  CONTENT_LENGTH => 51165,
  CONTENT_TYPE => "multipart/form-data; boundary=---------------------
+------7e122d10086",
  CONTEXT_DOCUMENT_ROOT => "/data/apache/cgi-bin/",
  CONTEXT_PREFIX => "/cgi-bin/",
  DOCUMENT_ROOT => "/data/apache/htdocs",
  GATEWAY_INTERFACE => "CGI/1.1",
  HTTP_ACCEPT => "image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
+ */*",
  HTTP_ACCEPT_ENCODING => "gzip, deflate",
  HTTP_ACCEPT_LANGUAGE => "en-us",
  HTTP_CACHE_CONTROL => "no-cache",
  HTTP_CONNECTION => "Keep-Alive",
  HTTP_HOST => "enterprise",
  HTTP_REFERER => "http://localhost/cgi-bin/file-upload-test",
  HTTP_USER_AGENT => "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.
+0)",
  LD_LIBRARY_PATH => "/usr/lib64/httpd",
  PATH => "/sbin:/usr/sbin:/bin:/usr/bin",
  QUERY_STRING => "",
  REMOTE_ADDR => "192.168.2.178",
  REMOTE_PORT => 1047,
  REQUEST_METHOD => "POST",
  REQUEST_SCHEME => "http",
  REQUEST_URI => "/cgi-bin/file-upload-test",
  SCRIPT_FILENAME => "/data/apache/cgi-bin/file-upload-test",
  SCRIPT_NAME => "/cgi-bin/file-upload-test",
  SERVER_ADDR => "192.168.2.10",
  SERVER_ADMIN => "me\@localhost",
  SERVER_NAME => "localhost",
  SERVER_PORT => 80,
  SERVER_PROTOCOL => "HTTP/1.1",
  SERVER_SIGNATURE => "",
  SERVER_SOFTWARE => "Apache"
);

      [download]

      Full path of notepad.exe in the Content-Disposition header, because IE 6.0 is broken.

      Note that IE 11 on Win7 behaves like any sane browser in this respect and transmits only filename and extension, but not the full path:

      $cgi = bless( {
  ".charset" => "ISO-8859-1",
  ".fieldnames" => {},
  ".parameters" => [
    "f"
  ],
  ".tmpfiles" => {
    "*File::Temp::\$fhnotepad.exe" => {
      hndl => bless( \*{'File::Temp::$fh'}, 'CGI::File::Temp' ),
      info => {
        "Content-Disposition" => "form-data; name=\"f\"; filename=\"no
+tepad.exe\"",
        "Content-Type" => "application/octet-stream"
      },
      name => "/tmp/HPMuRUrcGC"
    }
  },
  escape => 1,
  param => {
    f => [
      $cgi->{".tmpfiles"}{"*File::Temp::\$fhnotepad.exe"}{hndl}
    ]
  },
  use_tempfile => 1
}, 'CGI' );
%ENV = (
  CONTENT_LENGTH => 193222,
  CONTENT_TYPE => "multipart/form-data; boundary=---------------------
+------7e1f72b202b8",
  CONTEXT_DOCUMENT_ROOT => "/data/apache/cgi-bin/",
  CONTEXT_PREFIX => "/cgi-bin/",
  DOCUMENT_ROOT => "/data/apache/htdocs",
  GATEWAY_INTERFACE => "CGI/1.1",
  HTTP_ACCEPT => "text/html, application/xhtml+xml, */*",
  HTTP_ACCEPT_ENCODING => "gzip, deflate",
  HTTP_ACCEPT_LANGUAGE => "de-DE",
  HTTP_CACHE_CONTROL => "no-cache",
  HTTP_CONNECTION => "Keep-Alive",
  HTTP_DNT => 1,
  HTTP_HOST => "localhost",
  HTTP_REFERER => "http://localhost/cgi-bin/file-upload-test",
  HTTP_USER_AGENT => "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0;
+ rv:11.0) like Gecko",
  LD_LIBRARY_PATH => "/usr/lib64/httpd",
  PATH => "/sbin:/usr/sbin:/bin:/usr/bin",
  QUERY_STRING => "",
  REMOTE_ADDR => "192.168.2.140",
  REMOTE_PORT => 49458,
  REQUEST_METHOD => "POST",
  REQUEST_SCHEME => "http",
  REQUEST_URI => "/cgi-bin/file-upload-test",
  SCRIPT_FILENAME => "/data/apache/cgi-bin/file-upload-test",
  SCRIPT_NAME => "/cgi-bin/file-upload-test",
  SERVER_ADDR => "192.168.2.10",
  SERVER_ADMIN => "me\@localhost",
  SERVER_NAME => "localhost",
  SERVER_PORT => 80,
  SERVER_PROTOCOL => "HTTP/1.1",
  SERVER_SIGNATURE => "",
  SERVER_SOFTWARE => "Apache"
);

      [download]

      Alexander

      --
      Today I will gladly share my knowledge and experience, for there are no sweeter words than "I told you so". ;-)
[reply]
[d/l]
[select]

In Section Seekers of Perl Wisdom