comment on

firefox also sends the full filename

No, it doesn't. If you know better, name Firefox version and OS that does send the full path.

To demonstrate:

Put this as file-upload-test in a /cgi-bin/ folder and make it executable:

#!/usr/bin/perl

use strict;
use warnings;

use CGI qw( -no_xhtml -nosticky );
use Data::Dumper ();

my $cgi=CGI->new();
my $f=$cgi->upload('f');
my $text=Data::Dumper->new([$cgi,\%ENV],['cgi','*ENV'])->Useqq(1)->Sor
+tkeys(1)->Indent(1)->Quotekeys(0)->Dump();
print
        $cgi->header(
                -type=>'text/html'
        ),
        $cgi->start_html(
                -title=>'CGI Dump',
        ),
        $cgi->start_multipart_form(),
        $cgi->filefield(-name => 'f'),
        $cgi->submit(),
        $cgi->end_form(),
        $cgi->pre($text),
        $cgi->end_html();
[download]

Result of uploading C:\Windows\notepad.exe using FF 54.0, 32 bit, Windows:

$cgi = bless( {
  ".charset" => "ISO-8859-1",
  ".fieldnames" => {},
  ".parameters" => [
    "f"
  ],
  ".tmpfiles" => {
    "*File::Temp::\$fhnotepad.exe" => {
      hndl => bless( \*{'File::Temp::$fh'}, 'CGI::File::Temp' ),
      info => {
        "Content-Disposition" => "form-data; name=\"f\"; filename=\"no
+tepad.exe\"",
        "Content-Type" => "application/x-msdownload"
      },
      name => "/tmp/lteASdfRPK"
    }
  },
  escape => 1,
  param => {
    f => [
      $cgi->{".tmpfiles"}{"*File::Temp::\$fhnotepad.exe"}{hndl}
    ]
  },
  use_tempfile => 1
}, 'CGI' );
%ENV = (
  CONTENT_LENGTH => 193222,
  CONTENT_TYPE => "multipart/form-data; boundary=---------------------
+------232441531115",
  CONTEXT_DOCUMENT_ROOT => "/data/apache/cgi-bin/",
  CONTEXT_PREFIX => "/cgi-bin/",
  DOCUMENT_ROOT => "/data/apache/htdocs",
  GATEWAY_INTERFACE => "CGI/1.1",
  HTTP_ACCEPT => "text/html,application/xhtml+xml,application/xml;q=0.
+9,*/*;q=0.8",
  HTTP_ACCEPT_ENCODING => "gzip, deflate",
  HTTP_ACCEPT_LANGUAGE => "en-US,en;q=0.5",
  HTTP_CONNECTION => "keep-alive",
  HTTP_HOST => "localhost",
  HTTP_REFERER => "http://localhost/cgi-bin/file-upload-test",
  HTTP_UPGRADE_INSECURE_REQUESTS => 1,
  HTTP_USER_AGENT => "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:54.0) Gec
+ko/20100101 Firefox/54.0",
  LD_LIBRARY_PATH => "/usr/lib64/httpd",
  PATH => "/sbin:/usr/sbin:/bin:/usr/bin",
  QUERY_STRING => "",
  REMOTE_ADDR => "192.168.2.140",
  REMOTE_PORT => 49391,
  REQUEST_METHOD => "POST",
  REQUEST_SCHEME => "http",
  REQUEST_URI => "/cgi-bin/file-upload-test",
  SCRIPT_FILENAME => "/data/apache/cgi-bin/file-upload-test",
  SCRIPT_NAME => "/cgi-bin/file-upload-test",
  SERVER_ADDR => "192.168.2.10",
  SERVER_ADMIN => "me\@localhost",
  SERVER_NAME => "localhost",
  SERVER_PORT => 80,
  SERVER_PROTOCOL => "HTTP/1.1",
  SERVER_SIGNATURE => "",
  SERVER_SOFTWARE => "Apache"
);
[download]

No trace of C:\Windows\ in the output, because it was not sent by Firefox!

Result of uploading /bin/false using FF ESR 52.3.0, 64 bit, Linux:

$cgi = bless( {
  ".charset" => "ISO-8859-1",
  ".fieldnames" => {},
  ".parameters" => [
    "f"
  ],
  ".tmpfiles" => {
    "*File::Temp::\$fhfalse" => {
      hndl => bless( \*{'File::Temp::$fh'}, 'CGI::File::Temp' ),
      info => {
        "Content-Disposition" => "form-data; name=\"f\"; filename=\"fa
+lse\"",
        "Content-Type" => "application/octet-stream"
      },
      name => "/tmp/KTh3vytRsd"
    }
  },
  escape => 1,
  param => {
    f => [
      $cgi->{".tmpfiles"}{"*File::Temp::\$fhfalse"}{hndl}
    ]
  },
  use_tempfile => 1
}, 'CGI' );
%ENV = (
  CONTENT_LENGTH => 27458,
  CONTENT_TYPE => "multipart/form-data; boundary=---------------------
+------18269427081793764907232401438",
  CONTEXT_DOCUMENT_ROOT => "/data/apache/cgi-bin/",
  CONTEXT_PREFIX => "/cgi-bin/",
  DOCUMENT_ROOT => "/data/apache/htdocs",
  GATEWAY_INTERFACE => "CGI/1.1",
  HTTP_ACCEPT => "text/html,application/xhtml+xml,application/xml;q=0.
+9,*/*;q=0.8",
  HTTP_ACCEPT_ENCODING => "gzip, deflate",
  HTTP_ACCEPT_LANGUAGE => "en-US,en;q=0.5",
  HTTP_CONNECTION => "keep-alive",
  HTTP_HOST => "localhost",
  HTTP_REFERER => "http://localhost/cgi-bin/file-upload-test",
  HTTP_USER_AGENT => "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/2
+0100101 Firefox/52.0",
  LD_LIBRARY_PATH => "/usr/lib64/httpd",
  PATH => "/sbin:/usr/sbin:/bin:/usr/bin",
  QUERY_STRING => "",
  REMOTE_ADDR => "192.168.2.10",
  REMOTE_PORT => 60266,
  REQUEST_METHOD => "POST",
  REQUEST_SCHEME => "http",
  REQUEST_URI => "/cgi-bin/file-upload-test",
  SCRIPT_FILENAME => "/data/apache/cgi-bin/file-upload-test",
  SCRIPT_NAME => "/cgi-bin/file-upload-test",
  SERVER_ADDR => "192.168.2.10",
  SERVER_ADMIN => "me\@localhost",
  SERVER_NAME => "localhost",
  SERVER_PORT => 80,
  SERVER_PROTOCOL => "HTTP/1.1",
  SERVER_SIGNATURE => "",
  SERVER_SOFTWARE => "Apache"
);
[download]

No trace of /bin/ in the output, because it was not sent by Firefox!

To compare: Result of uploading c:\WINNT\notepad.exe, with Internet Explorer 6.0, Windows 2000:

$cgi = bless( {
  ".charset" => "ISO-8859-1",
  ".fieldnames" => {},
  ".parameters" => [
    "f"
  ],
  ".tmpfiles" => {
    "*File::Temp::\$fhc:\\WINNT\\NOTEPAD.EXE" => {
      hndl => bless( \*{'File::Temp::$fh'}, 'CGI::File::Temp' ),
      info => {
        "Content-Disposition" => "form-data; name=\"f\"; filename=\"c:
+\\WINNT\\NOTEPAD.EXE\"",
        "Content-Type" => "application/octet-stream"
      },
      name => "/tmp/n93zfrd2Bf"
    }
  },
  escape => 1,
  param => {
    f => [
      $cgi->{".tmpfiles"}{"*File::Temp::\$fhc:\\WINNT\\NOTEPAD.EXE"}{h
+ndl}
    ]
  },
  use_tempfile => 1
}, 'CGI' );
%ENV = (
  CONTENT_LENGTH => 51165,
  CONTENT_TYPE => "multipart/form-data; boundary=---------------------
+------7e122d10086",
  CONTEXT_DOCUMENT_ROOT => "/data/apache/cgi-bin/",
  CONTEXT_PREFIX => "/cgi-bin/",
  DOCUMENT_ROOT => "/data/apache/htdocs",
  GATEWAY_INTERFACE => "CGI/1.1",
  HTTP_ACCEPT => "image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
+ */*",
  HTTP_ACCEPT_ENCODING => "gzip, deflate",
  HTTP_ACCEPT_LANGUAGE => "en-us",
  HTTP_CACHE_CONTROL => "no-cache",
  HTTP_CONNECTION => "Keep-Alive",
  HTTP_HOST => "enterprise",
  HTTP_REFERER => "http://localhost/cgi-bin/file-upload-test",
  HTTP_USER_AGENT => "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.
+0)",
  LD_LIBRARY_PATH => "/usr/lib64/httpd",
  PATH => "/sbin:/usr/sbin:/bin:/usr/bin",
  QUERY_STRING => "",
  REMOTE_ADDR => "192.168.2.178",
  REMOTE_PORT => 1047,
  REQUEST_METHOD => "POST",
  REQUEST_SCHEME => "http",
  REQUEST_URI => "/cgi-bin/file-upload-test",
  SCRIPT_FILENAME => "/data/apache/cgi-bin/file-upload-test",
  SCRIPT_NAME => "/cgi-bin/file-upload-test",
  SERVER_ADDR => "192.168.2.10",
  SERVER_ADMIN => "me\@localhost",
  SERVER_NAME => "localhost",
  SERVER_PORT => 80,
  SERVER_PROTOCOL => "HTTP/1.1",
  SERVER_SIGNATURE => "",
  SERVER_SOFTWARE => "Apache"
);
[download]

Full path of notepad.exe in the Content-Disposition header, because IE 6.0 is broken.

Note that IE 11 on Win7 behaves like any sane browser in this respect and transmits only filename and extension, but not the full path:

$cgi = bless( {
  ".charset" => "ISO-8859-1",
  ".fieldnames" => {},
  ".parameters" => [
    "f"
  ],
  ".tmpfiles" => {
    "*File::Temp::\$fhnotepad.exe" => {
      hndl => bless( \*{'File::Temp::$fh'}, 'CGI::File::Temp' ),
      info => {
        "Content-Disposition" => "form-data; name=\"f\"; filename=\"no
+tepad.exe\"",
        "Content-Type" => "application/octet-stream"
      },
      name => "/tmp/HPMuRUrcGC"
    }
  },
  escape => 1,
  param => {
    f => [
      $cgi->{".tmpfiles"}{"*File::Temp::\$fhnotepad.exe"}{hndl}
    ]
  },
  use_tempfile => 1
}, 'CGI' );
%ENV = (
  CONTENT_LENGTH => 193222,
  CONTENT_TYPE => "multipart/form-data; boundary=---------------------
+------7e1f72b202b8",
  CONTEXT_DOCUMENT_ROOT => "/data/apache/cgi-bin/",
  CONTEXT_PREFIX => "/cgi-bin/",
  DOCUMENT_ROOT => "/data/apache/htdocs",
  GATEWAY_INTERFACE => "CGI/1.1",
  HTTP_ACCEPT => "text/html, application/xhtml+xml, */*",
  HTTP_ACCEPT_ENCODING => "gzip, deflate",
  HTTP_ACCEPT_LANGUAGE => "de-DE",
  HTTP_CACHE_CONTROL => "no-cache",
  HTTP_CONNECTION => "Keep-Alive",
  HTTP_DNT => 1,
  HTTP_HOST => "localhost",
  HTTP_REFERER => "http://localhost/cgi-bin/file-upload-test",
  HTTP_USER_AGENT => "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0;
+ rv:11.0) like Gecko",
  LD_LIBRARY_PATH => "/usr/lib64/httpd",
  PATH => "/sbin:/usr/sbin:/bin:/usr/bin",
  QUERY_STRING => "",
  REMOTE_ADDR => "192.168.2.140",
  REMOTE_PORT => 49458,
  REQUEST_METHOD => "POST",
  REQUEST_SCHEME => "http",
  REQUEST_URI => "/cgi-bin/file-upload-test",
  SCRIPT_FILENAME => "/data/apache/cgi-bin/file-upload-test",
  SCRIPT_NAME => "/cgi-bin/file-upload-test",
  SERVER_ADDR => "192.168.2.10",
  SERVER_ADMIN => "me\@localhost",
  SERVER_NAME => "localhost",
  SERVER_PORT => 80,
  SERVER_PROTOCOL => "HTTP/1.1",
  SERVER_SIGNATURE => "",
  SERVER_SOFTWARE => "Apache"
);
[download]

Alexander

--
Today I will gladly share my knowledge and experience, for there are no sweeter words than "I told you so". ;-)

In reply to Re^4: Error ftping file with Net::FTP by afoken
in thread Error ftping file with Net::FTP by Anonymous Monk

Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!

Titles consisting of a single word are discouraged, and in most cases are disallowed outright.

Read Where should I post X? if you're not absolutely sure you're posting in the right place.

Please read these before you post! —

Posts may use any of the Perl Monks Approved HTML tags:

a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr

You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)

	For:		Use:
	&		`&`
	<		`<`
	>		`>`
	[		`[`
	]		`]`

Link using PerlMonks shortcuts! What shortcuts can I use for linking?

See Writeup Formatting Tips and other pages linked from there for more info.