Then I do wonder what it was intended for then, if not for tracking the state of uploads.
I made up a small example, using bits of your code:
The upload-form: (form.html)
<!-- using GET will make the QUERY_STRING as mentioned in the previous + post, but.. that's not how it's supposed to be? --> <form action="minitest.cgi" enctype="multipart/form-data" method="GET" +> <input type="file" name="file"> <input type="submit" value="send"> <input type="hidden" name="pregeneratedID" value="123456"> </form>
the upload-script: (minitest.cgi)
#!/usr/bin/perl -w use strict; use CGI qw/:standard/; use CGI::Carp qw(fatalsToBrowser); my $query = CGI->new($ENV{QUERY_STRING}); # I will initially save my file with this name and copy it to the corr +ect name later (ID+original suffix) # ID has to be passed to 'hook', to keep track of the upload-status in + a DB (I will just use a plain file here for testing) # as only $filename (the originale name on the client-disk is passed t +o the hook, there is no relation between the # sanitized filename I will use when saving the uploaded file, and the + filename used in the hook, thus practically rendering # the hook useless my $data = $query->param('pregeneratedID'); if (!$data) { print $query->header(); print "no data?"; exit; } $data = $1 if $data =~ //;# untaint generatedID - for some reason this + sets the contents of $data to .. nothing if (!$data) { print $query->header(); print "no data?"; exit; } $query = CGI->new(\&hook, $data); my $fh = $query->upload('file'); # I want to save the file with the same filename as the ID (so it's ea +sier to keep track of during download) # for testing purposes, I will not handle renaming and moving the file + in this example my $name = $data; open ( UPLOADFILE, ">uploads/$name" ) or die ("$!"); binmode UPLOADFILE; while ( <$fh> ) { print UPLOADFILE; } close UPLOADFILE; print $query->header(); print "look in uploads/test.log and see if $data was passed to the hoo +k<br>\n"; print "If the file is not there, it means hook was never called, provi +ng the manual right (blasted!))<br>\n"; print "filetype: ".$query->uploadInfo($fh)->{'Content-Type'}; # this b +arfs, as nothing survives the sanitizing.. #### sub hook { my ($filename,$buffer,$bytes_received,$data) = @_; open (LOG, ">>uploads/test.log"); print LOG $filename." ".$bytes_received. " - ".$data."\n"; close (LOG); }
This leaves me with an empty file in uploads/ named '123456' and no log-file, meaning the hook wasn't called.
I can only conclude, that the hook-feature makes it possible to either keep track of a specific upload by using un-sanitized filenames, giving me the option of actually using the progress-information logged by the hook, or using fully sanitized filenames in the hook as well, (by generating the ID within the upload-script, before declaring the cgi-obj), but then not having any posibilities of keeping track of the upload while it is in progress.. unless CGI.pm is modified so it will pass more information from the upload-handler. As I see it, the $data-option is nearly useless
Of course, if there is any other way of doing this in a nice way, don't keep it back :)
In reply to Re^2: Passing database ID to \&hook through $data (CGI)
by k2OS
in thread Passing database ID to \&hook through $data (CGI)
by k2OS
| For: | Use: | ||
| & | & | ||
| < | < | ||
| > | > | ||
| [ | [ | ||
| ] | ] |