cannot set the value in the html <input type="file">??

Discussion in 'Javascript' started by Matt, Oct 16, 2004.

  1. Matt

    Matt Guest

    If I do the following, the browse text box still cannot see
    C:/hello world/test.txt.

    <input type="file" name="fileName" value="C:/hello world/test.txt" size=80>


    Any ideas? and workarounds to this problem? thanks!!
     
    Matt, Oct 16, 2004
    #1
    1. Advertising

  2. Matt

    Randy Webb Guest

    Matt wrote:
    > If I do the following, the browse text box still cannot see
    > C:/hello world/test.txt.
    >
    > <input type="file" name="fileName" value="C:/hello world/test.txt" size=80>
    >
    >
    > Any ideas? and workarounds to this problem? thanks!!


    The reason you can not set the value is a security issue. Imagine if you
    could set it. The page loads, sets the value, then autosubmits the form.
    I could gain any file on your computer I wanted, that I know the path to.

    --
    Randy
    comp.lang.javascript FAQ - http://jibbering.com/faq
    Answer:It destroys the order of the conversation
    Question: Why?
    Answer: Top-Posting.
    Question: Whats the most annoying thing on Usenet?
     
    Randy Webb, Oct 16, 2004
    #2
    1. Advertising

  3. Matt

    Grant Wagner Guest

    Matt wrote:

    > If I do the following, the browse text box still cannot see
    > C:/hello world/test.txt.
    >
    > <input type="file" name="fileName" value="C:/hello world/test.txt" size=80>
    >
    > Any ideas? and workarounds to this problem? thanks!!


    <url: http://www.w3.org/TR/REC-html40/interact/forms.html#h-17.4.1 /> says:
    "...User agents may use the value of the value attribute as the initial file
    name..." (note the word _may_, it's important). I then tested the following:

    <form><input type="file" value="c:\\test.txt"></form>

    In IE 6.0.2800, Firefox 1.0PR, Mozilla 1.7.3, Opera 7.54 and Netscape 4.78, the
    file input was empty. Only in Opera 6.05 did the VALUE I specified appear. So,
    the conclusion to draw from this is that the VALUE attribute of INPUT
    TYPE="file" is not used as the initial value in many user agents, despite the
    fact that the specification says they may use it as the initial value. And there
    is a very good reason for this.

    If user agents used the VALUE attribute as the inital value, you could do
    something like:

    <body onload="document.forms['stealSam'].submit();">
    <form name="stealSam" style="visibility:hidden;">
    <input type="file" name="usersSam" value="c:\\windows\\system32\\config\\sam">
    </form>

    Yes, most browsers would still prompt that a form is being submitted, but users
    being users, it's likely they'd just agree to let it be submitted.

    --
    Grant Wagner <>
    comp.lang.javascript FAQ - http://jibbering.com/faq
     
    Grant Wagner, Oct 20, 2004
    #3
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Matt
    Replies:
    2
    Views:
    15,163
    nice.guy.nige
    Oct 16, 2004
  2. Replies:
    2
    Views:
    8,584
  3. Polaris
    Replies:
    3
    Views:
    1,764
    Masudur
    Jun 24, 2007
  4. Roberto
    Replies:
    3
    Views:
    332
  5. Susan Cranford
    Replies:
    2
    Views:
    430
Loading...

Share This Page