It is true, even if you do not want to hear it. Only MS IE sends the entire file name including drive letter and directories, all other browsers I know, including Firefox, Netscape, Opera and Konqueror, send only the file name. Copy the following file into a CGI enabled directory of a webserver as uploadtest.cgi and see for yourself: Open http://server/cgi-bin/uploadtest.cgi, choose any file, and click the submit button.
#!/usr/bin/perl -Tw
use strict;
use CGI qw(:all);
use Data::Dumper;
if (request_method() eq 'POST') {
my $f=param('f');
my $info=uploadInfo($f);
print
header(),
start_html(),
h1('Upload Metadata'),
pre(escapeHTML(Dumper($info))),
end_html();
} else {
print
header(),
start_html(),
start_multipart_form(),
filefield(-name=>'f',-size=>50),
submit(),
end_form(),
end_html();
}
Result with Firefox 3.0.8:
$VAR1 = {
'Content-Type' => 'application/octet-stream',
'Content-Disposition' => 'form-data; name="f"; filename="win
+.ini"'
};
Result with IE 6.0.2800.1106:
$VAR1 = {
'Content-Type' => 'application/octet-stream',
'Content-Disposition' => 'form-data; name="f"; filename="C:\
+\WINNT\\win.ini"'
};
OK, let's be paranoid and let's assume Lincoln D. Stein and me added some evil code into CGI.pm just to make your life harder. So let's get rid of CGI.pm and look at the raw, unparsed data. Copy the following script as uploadtest2.cgi into the CGI-enabled directory of the webserver:
#!/usr/bin/perl -Tw
use strict;
print
"Content-Type: text/html\015\012\015\012";
if ($ENV{'REQUEST_METHOD'} eq 'POST') {
print
"<html><body><plaintext>";
print while <STDIN>;
} else {
print
'<html><body>',
'<form method="post" action="" enctype="multipart/form
+-data">',
'<input type="file" name="f" size="50">',
'<input type="submit">',
'</form></body></html>';
}
Result with FF:
-----------------------------114782935826962
Content-Disposition: form-data; name="f"; filename="win.ini"
Content-Type: application/octet-stream
# file content here
Result with IE:
-----------------------------7d936e1f40214
Content-Disposition: form-data; name="f"; filename="C:\WINNT\win.ini"
Content-Type: application/octet-stream
# file content here
Alexander
--
Today I will gladly share my knowledge and experience, for there are no sweeter words than "I told you so". ;-)
|