When you request a file via <input type="file" name="f1"/>, what you get back in your parameters is browser dependent. IE7 (and IE8?) sends the full local path name. Firefox only sends back a relative local path name. So this isn't likely a CGI problem at all. Some developers feel that providing the full path name might violate your privacy and make your machine less secure.

Also, if the full filename is passed, your machine (or the source machine) may not have access to the directory. This is for security purposes. You are usually better served by deciding in advance where files are to be stored and setting permissions appropriately:

• Read only for source directories and files
• Write (only) for target directories (if system wide)
• Read/Write for target directories owned by the target user

This way, the client side can upload (but not download or view) files on the source. The client can download to permitted locations on the client side system. The client can do whatever they want in their own file structure.