daveyboy has asked for the wisdom of the Perl Monks concerning the following question:

Greetings All!

I'm new here.

A few days ago, I read the article on HTML::TEMPLATE by "jeffa", but I can't figure out how to use this site to discover how to reach him by email.

So I thought I'd post here, asking for help.

I've created a form that has some user text fields, plus some file upload fields in it.

I used the "associate" parameter, as "jeffa" described, so that if somebody forgets to fill out a field or makes a mistake with the contents of a field, the whole form reloads itself, with all of the user's previously-typed-in field-info still in-place...

...EXCEPT for the file upload fields!

I can't figure out how to get these (there are five on the form) to reload the path information into themselves.

I'm using:



$form_template->param(
          PRICE =>$Price,
          FILE1 =>$FileURL1,
          FILE2 =>$FileURL2,
          FILE3 =>$FileURL3,
          FILE4 =>$FileURL4,
          THUMBIMAGE =>$ThumbImageURL,
  );
print $form_template->output;

[download]
(I've kept out the other variables for clarity.)

And my form fields are written like this:


<input type="file" name="File1" value="<TMPL_VAR NAME=FILE1>" size="20
+"> 

<input type="file" name="File2" value="<TMPL_VAR NAME=FILE2>" size="20
+"> 

etc...

[download]
If I fill out the form properly, everything uploads just fine. I just would like to get the form to completely reload whatever form-data the user has already typed in the first time.

Thanks!

-= DaveyBoy =-

Replies are listed 'Best First'.
(jeffa) Re: HTML::TEMPLATE question
by jeffa (Bishop) on Jan 15, 2002 at 20:58 UTC
    Well, here i am. :D

    Let it be said that i am a file upload newbie. I have a written a few, but i tend to find other means for file uploading. That being said, take my advice with a grain of salt (or a whole saltlick).

    I really think the problem lies within the file upload form element itself. Consider this code: 

    use strict;
use CGI;
use HTML::Template;

my $cgi      = CGI->new();
my $data     = do {local $/; <DATA>};
my $template = HTML::Template->new(
 scalarref => \$data,
);

$template->param(
 text1 => 'Text1', 
 file1 => 'File1', 
);

print $cgi->header(), $template->output();

__DATA__
<html>
<head>
<title>uploader</title>
</head>
<body>

<form action="upload.cgi" method="POST" enctype="multipart/form-data">
<input type="text" name="Text1" value="<TMPL_VAR NAME=TEXT1>" size="20
+">
<p>
<input type="file" name="File1" value="<TMPL_VAR NAME=FILE1>" size="20
+">
<p>
<input type="file" name="File2" value="blah blah blah" size="20">
<p>
<input type="submit" name="Go">
</form>

</body>
</html>

    [download]

    Here i am not using HTML::Template's associate option, instead i am assigning literal values inside param(). I set the first file upload field's value and the text field's value, but the second upload field's value is 'hard-coded' in the HTML itself. When you run this, the text field will indeed start with a pre-defined value, but the upload fields will not. (update - aha it is a security issue, thanks for your insight, theorbtwo).

    Alas, i can't find a way to solve your problem. I can suggest breaking the form up - never easy on the coder, but it might be better for the end user if it is large enough. Good luck (very good question!), and feel free to ask more questions (and solve the ones you know the answer to). </code>

    jeffa

    L-LL-L--L-LL-L--L-LL-L--
-R--R-RR-R--R-RR-R--R-RR
F--F--F--F--F--F--F--F--
(the triplet paradiddle)
[reply]
[d/l]

      The upload fields will never start with a predefined value; it's considered a security risk. What if you aranged your form such that an unsuspecting user wouldn't notice the upload form element, and defaulted it to (say), c:\windows\default.pwl? I could have sworn this was part of the offical spec, but I can't find it there. The offical spec recommends validating the default choices if specified, but in pratice, browsers just ignore the defaults. See http://www.w3.org/TR/html401/appendix/notes.html#forms-security.

      Thanks,
      James Mastros,
      Just Another Perl Scribe

[reply]
        Thanks for the help! I see what you mean by the security risk.

        Take care!

        -= DaveyBoy =-
[reply]
      Thanks for your help, jeffa !!


      -= DaveyBoy =-
[reply]
Re: HTML::TEMPLATE question
by George_Sherston (Vicar) on Jan 15, 2002 at 20:47 UTC
    I think this is a CGI.pm issue, rather than an HTML::Template issue. Are you defining a -default argument when you call $cgi->filefield() to create the upload field? If so, that may be what stops it doing what you want. Here's what I think is the relevant bit of the CGI docs:

    The optional second parameter is the starting value for the field contents to be used as the default file name (-default). For security reasons, browsers don't pay any attention to this field, and so the starting value will always be blank. Worse, the field loses its "sticky" behavior and forgets its previous contents. The starting value field is called for in the HTML specification, however, and possibly some browser will eventually provide support for it.

    (emphasis added). Hope that's some help.

    Update: having re-read the question more attentively (*wry grin*) I see you're not using CGI to make the field, but you do have a "value" element in your field: it might be worth seeing what happens if you take that out first time round.

    § George Sherston
[reply]
[d/l]
[select]

Back to Seekers of Perl Wisdom