Copy File Field Value to Dynamic File Field Value

Discussion in 'Javascript' started by VUNETdotUS, Nov 7, 2007.

  1. VUNETdotUS

    VUNETdotUS Guest

    Firefox showed me a security error when I was copying a value of file
    field object into new DOM created input file field. Can I do something
    about it?
    Thanks.
    VUNETdotUS, Nov 7, 2007
    #1
    1. Advertising

  2. VUNETdotUS

    s0lnic Guest

    VUNETdotUS wrote:

    > Firefox showed me a security error when I was copying a value of file
    > field object into new DOM created input file field. Can I do something
    > about it?


    Nope, it's a security issue, you're not able to manipulate file fields.

    --
    # Regards || piotr[.]solnica[at]gmail[.]com || jid : #
    # s0lnic || http://blog.solnic.in5.pl || icq : 385935391 #
    s0lnic, Nov 7, 2007
    #2
    1. Advertising

  3. VUNETdotUS

    VUNETdotUS Guest

    On Nov 7, 9:55 am, s0lnic <> wrote:
    > VUNETdotUS wrote:
    > > Firefox showed me a security error when I was copying a value of file
    > > field object into new DOM created input file field. Can I do something
    > > about it?

    >
    > Nope, it's a security issue, you're not able to manipulate file fields.
    >
    > --
    > # Regards || piotr[.]solnica[at]gmail[.]com || jid : #
    > # s0lnic ||http://blog.solnic.in5.pl || icq : 385935391 #


    can I copy input as a DOM object to another form (thus keeping its
    value)?
    VUNETdotUS, Nov 7, 2007
    #3
  4. VUNETdotUS

    s0lnic Guest

    VUNETdotUS wrote:

    > can I copy input as a DOM object to another form (thus keeping its
    > value)?


    Well, you can do something like:

    var fileField = document.getElementById('file_field_id');
    var clonedFileField = fileField.cloneNode(true);
    document.getElementById('some_form').appendChild(clonedFileField);

    This should work fine on gecko-based browsers, but I'm not sure about Opera
    and IEs.

    --
    # Regards || piotr[.]solnica[at]gmail[.]com || jid : #
    # s0lnic || http://blog.solnic.in5.pl || icq : 385935391 #
    s0lnic, Nov 7, 2007
    #4
  5. VUNETdotUS

    VUNETdotUS Guest

    On Nov 7, 12:51 pm, Randy Webb <> wrote:
    > VUNETdotUS said the following on 11/7/2007 9:33 AM:
    >
    > > Firefox showed me a security error when I was copying a value of file
    > > field object into new DOM created input file field. Can I do something
    > > about it?

    >
    > Yes. Stop trying to copy the value of a file input.


    Sounds inspiring.

    >
    > --
    > Randy
    > Chance Favors The Prepared Mind
    > comp.lang.javascript FAQ -http://jibbering.com/faq/index.html
    > Javascript Best Practices -http://www.JavascriptToolbox.com/bestpractices/
    VUNETdotUS, Nov 7, 2007
    #5
  6. VUNETdotUS

    VUNETdotUS Guest

    On Nov 7, 2:03 pm, Randy Webb <> wrote:
    > s0lnic said the following on 11/7/2007 1:30 PM:
    >
    > > VUNETdotUS wrote:

    >
    > >> can I copy input as a DOM object to another form (thus keeping its
    > >> value)?

    >
    > > Well, you can do something like:

    >
    > > var fileField = document.getElementById('file_field_id');
    > > var clonedFileField = fileField.cloneNode(true);
    > > document.getElementById('some_form').appendChild(clonedFileField);

    >
    > > This should work fine on gecko-based browsers, but I'm not sure about Opera
    > > and IEs.

    >
    > Don't let the IE bashing crowd know that IE gets something right with
    > regards to security and Gecko-based/Opera browsers get it wrong. Namely,
    > that you shouldn't, under any circumstance, be able to set the value of
    > a file input.
    >
    > --
    > Randy
    > Chance Favors The Prepared Mind
    > comp.lang.javascript FAQ -http://jibbering.com/faq/index.html
    > Javascript Best Practices -http://www.JavascriptToolbox.com/bestpractices/


    I do not really set the value. User sets the value, then I run the
    script to take that value, create a new form in DOM, append new input
    file field with user-defined value to this new form and submit.
    I need it to upload the files without refreshing the page. So, my new
    form is submitting to iframe and user keeps on working with current
    visible form.
    Any suggestions, perhaps?
    Thanks
    VUNETdotUS, Nov 7, 2007
    #6
  7. VUNETdotUS

    VUNETdotUS Guest

    On Nov 7, 2:24 pm, Randy Webb <> wrote:
    > VUNETdotUS said the following on 11/7/2007 2:19 PM:
    >
    >
    >
    > > On Nov 7, 2:03 pm, Randy Webb <> wrote:
    > >> s0lnic said the following on 11/7/2007 1:30 PM:

    >
    > >>> VUNETdotUS wrote:
    > >>>> can I copy input as a DOM object to another form (thus keeping its
    > >>>> value)?
    > >>> Well, you can do something like:
    > >>> var fileField = document.getElementById('file_field_id');
    > >>> var clonedFileField = fileField.cloneNode(true);
    > >>> document.getElementById('some_form').appendChild(clonedFileField);
    > >>> This should work fine on gecko-based browsers, but I'm not sure about Opera
    > >>> and IEs.
    > >> Don't let the IE bashing crowd know that IE gets something right with
    > >> regards to security and Gecko-based/Opera browsers get it wrong. Namely,
    > >> that you shouldn't, under any circumstance, be able to set the value of
    > >> a file input.

    >
    > > I do not really set the value. User sets the value, then I run the
    > > script to take that value, create a new form in DOM, append new input
    > > file field with user-defined value to this new form and submit.

    >
    > Why? Why not just submit the current form to an IFrame and be finished
    > with it? If you want to upload multiple files, then simply create new
    > File inputs dynamically and then submit the form.
    >
    > > I need it to upload the files without refreshing the page. So, my new
    > > form is submitting to iframe and user keeps on working with current
    > > visible form.
    > > Any suggestions, perhaps?

    >
    > If you want to be able to keep working on the same page, break the form
    > into separate forms. Submit the first to the IFrame and it will leave
    > them happily working.
    >
    > --
    > Randy
    > Chance Favors The Prepared Mind
    > comp.lang.javascript FAQ -http://jibbering.com/faq/index.html
    > Javascript Best Practices -http://www.JavascriptToolbox.com/bestpractices/


    that could be one of the solutions, but if I keep one form, can I
    clone the file object, perhaps? Or, is it the only solution to break
    the form?
    Thanks
    VUNETdotUS, Nov 7, 2007
    #7
  8. VUNETdotUS

    Darko Guest

    On Nov 7, 9:00 pm, VUNETdotUS <> wrote:
    > On Nov 7, 2:24 pm, Randy Webb <> wrote:
    >
    >
    >
    > > VUNETdotUS said the following on 11/7/2007 2:19 PM:

    >
    > > > On Nov 7, 2:03 pm, Randy Webb <> wrote:
    > > >> s0lnic said the following on 11/7/2007 1:30 PM:

    >
    > > >>> VUNETdotUS wrote:
    > > >>>> can I copy input as a DOM object to another form (thus keeping its
    > > >>>> value)?
    > > >>> Well, you can do something like:
    > > >>> var fileField = document.getElementById('file_field_id');
    > > >>> var clonedFileField = fileField.cloneNode(true);
    > > >>> document.getElementById('some_form').appendChild(clonedFileField);
    > > >>> This should work fine on gecko-based browsers, but I'm not sure about Opera
    > > >>> and IEs.
    > > >> Don't let the IE bashing crowd know that IE gets something right with
    > > >> regards to security and Gecko-based/Opera browsers get it wrong. Namely,
    > > >> that you shouldn't, under any circumstance, be able to set the value of
    > > >> a file input.

    >
    > > > I do not really set the value. User sets the value, then I run the
    > > > script to take that value, create a new form in DOM, append new input
    > > > file field with user-defined value to this new form and submit.

    >
    > > Why? Why not just submit the current form to an IFrame and be finished
    > > with it? If you want to upload multiple files, then simply create new
    > > File inputs dynamically and then submit the form.

    >
    > > > I need it to upload the files without refreshing the page. So, my new
    > > > form is submitting to iframe and user keeps on working with current
    > > > visible form.
    > > > Any suggestions, perhaps?

    >
    > > If you want to be able to keep working on the same page, break the form
    > > into separate forms. Submit the first to the IFrame and it will leave
    > > them happily working.

    >
    > > --
    > > Randy
    > > Chance Favors The Prepared Mind
    > > comp.lang.javascript FAQ -http://jibbering.com/faq/index.html
    > > Javascript Best Practices -http://www.JavascriptToolbox.com/bestpractices/

    >
    > that could be one of the solutions, but if I keep one form, can I
    > clone the file object, perhaps? Or, is it the only solution to break
    > the form?
    > Thanks


    Randy Webb used to write some good posts in the past, but with all due
    respect breaking the page into iframes sound horrible. As for the
    question, if the topic starter only read what he head been told, he
    would have noticed that s0lnic gave him the solution above, with code
    and everything. And it works. It is no security issue whatsoever,
    since you only clone what the client had already filled in, so I don't
    see a reason for panic.
    Darko, Nov 7, 2007
    #8
  9. VUNETdotUS

    VUNETdotUS Guest

    On Nov 7, 3:28 pm, Darko <> wrote:
    > On Nov 7, 9:00 pm, VUNETdotUS <> wrote:
    >
    >
    >
    > > On Nov 7, 2:24 pm, Randy Webb <> wrote:

    >
    > > > VUNETdotUS said the following on 11/7/2007 2:19 PM:

    >
    > > > > On Nov 7, 2:03 pm, Randy Webb <> wrote:
    > > > >> s0lnic said the following on 11/7/2007 1:30 PM:

    >
    > > > >>> VUNETdotUS wrote:
    > > > >>>> can I copy input as a DOM object to another form (thus keeping its
    > > > >>>> value)?
    > > > >>> Well, you can do something like:
    > > > >>> var fileField = document.getElementById('file_field_id');
    > > > >>> var clonedFileField = fileField.cloneNode(true);
    > > > >>> document.getElementById('some_form').appendChild(clonedFileField);
    > > > >>> This should work fine on gecko-based browsers, but I'm not sure about Opera
    > > > >>> and IEs.
    > > > >> Don't let the IE bashing crowd know that IE gets something right with
    > > > >> regards to security and Gecko-based/Opera browsers get it wrong. Namely,
    > > > >> that you shouldn't, under any circumstance, be able to set the value of
    > > > >> a file input.

    >
    > > > > I do not really set the value. User sets the value, then I run the
    > > > > script to take that value, create a new form in DOM, append new input
    > > > > file field with user-defined value to this new form and submit.

    >
    > > > Why? Why not just submit the current form to an IFrame and be finished
    > > > with it? If you want to upload multiple files, then simply create new
    > > > File inputs dynamically and then submit the form.

    >
    > > > > I need it to upload the files without refreshing the page. So, my new
    > > > > form is submitting to iframe and user keeps on working with current
    > > > > visible form.
    > > > > Any suggestions, perhaps?

    >
    > > > If you want to be able to keep working on the same page, break the form
    > > > into separate forms. Submit the first to the IFrame and it will leave
    > > > them happily working.

    >
    > > > --
    > > > Randy
    > > > Chance Favors The Prepared Mind
    > > > comp.lang.javascript FAQ -http://jibbering.com/faq/index.html
    > > > Javascript Best Practices -http://www.JavascriptToolbox.com/bestpractices/

    >
    > > that could be one of the solutions, but if I keep one form, can I
    > > clone the file object, perhaps? Or, is it the only solution to break
    > > the form?
    > > Thanks

    >
    > Randy Webb used to write some good posts in the past, but with all due
    > respect breaking the page into iframes sound horrible. As for the
    > question, if the topic starter only read what he head been told, he
    > would have noticed that s0lnic gave him the solution above, with code
    > and everything. And it works. It is no security issue whatsoever,
    > since you only clone what the client had already filled in, so I don't
    > see a reason for panic.


    I do not know how it happened but I never saw a second rely from
    s0lnic. cloneNode seems to be not browser compatible, doesn't it? I'll
    try to test now...
    Thanks.
    VUNETdotUS, Nov 7, 2007
    #9
  10. VUNETdotUS

    VUNETdotUS Guest

    On Nov 7, 3:40 pm, VUNETdotUS <> wrote:
    > On Nov 7, 3:28 pm, Darko <> wrote:


    > s0lnic. cloneNode seems to be not browser compatible, doesn't it? I'll
    > try to test now...
    > Thanks.


    Obviously, IE doe snot support. Is anyone familiar with cross browser
    idea for cloning?
    VUNETdotUS, Nov 7, 2007
    #10
  11. VUNETdotUS

    s0lnic Guest

    VUNETdotUS wrote:

    > Obviously, IE doe snot support. Is anyone familiar with cross browser
    > idea for cloning?


    Oh well ;) Why do you want to clone them anyway? What do you want to
    achieve?

    --
    # Regards || piotr[.]solnica[at]gmail[.]com || jid : #
    # s0lnic || http://blog.solnic.in5.pl || icq : 385935391 #
    s0lnic, Nov 7, 2007
    #11
  12. VUNETdotUS

    VUNETdotUS Guest

    On Nov 7, 5:05 pm, s0lnic <> wrote:
    > VUNETdotUS wrote:
    > > Obviously, IE doe snot support. Is anyone familiar with cross browser
    > > idea for cloning?

    >
    > Oh well ;) Why do you want to clone them anyway? What do you want to
    > achieve?
    >
    > --
    > # Regards || piotr[.]solnica[at]gmail[.]com || jid : #
    > # s0lnic ||http://blog.solnic.in5.pl || icq : 385935391 #


    I need it to upload the files without refreshing the page. So, my new
    hidden,
    dynamically created DOM
    form is submitting file value to iframe and user keeps on working with
    current
    visible form.
    VUNETdotUS, Nov 7, 2007
    #12
  13. VUNETdotUS

    s0lnic Guest

    VUNETdotUS wrote:

    > I need it to upload the files without refreshing the page. So, my new
    > hidden,
    > dynamically created DOM
    > form is submitting file value to iframe and user keeps on working with
    > current
    > visible form.


    Oh, so submit the form and dynamically create a new one...user won't see
    anything, don't worry. This method works on every major browser.

    --
    # Regards || piotr[.]solnica[at]gmail[.]com || jid : #
    # s0lnic || http://blog.solnic.in5.pl || icq : 385935391 #
    s0lnic, Nov 7, 2007
    #13
  14. VUNETdotUS

    VUNETdotUS Guest

    On Nov 7, 5:44 pm, s0lnic <> wrote:
    > VUNETdotUS wrote:
    > > I need it to upload the files without refreshing the page. So, my new
    > > hidden,
    > > dynamically created DOM
    > > form is submitting file value to iframe and user keeps on working with
    > > current
    > > visible form.

    >
    > Oh, so submit the form and dynamically create a new one...user won't see
    > anything, don't worry. This method works on every major browser.
    >
    > --
    > # Regards || piotr[.]solnica[at]gmail[.]com || jid : #
    > # s0lnic ||http://blog.solnic.in5.pl || icq : 385935391 #


    do you mean I have to submit the original for and then repaint it
    plugging all values in? I do not know really...
    VUNETdotUS, Nov 7, 2007
    #14
  15. VUNETdotUS

    Darko Guest

    On Nov 7, 10:47 pm, VUNETdotUS <> wrote:
    > On Nov 7, 3:40 pm, VUNETdotUS <> wrote:
    >
    > > On Nov 7, 3:28 pm, Darko <> wrote:
    > > s0lnic. cloneNode seems to be not browser compatible, doesn't it? I'll
    > > try to test now...
    > > Thanks.

    >
    > Obviously, IE doe snot support. Is anyone familiar with cross browser
    > idea for cloning?


    Try it harder. Maybe s0lnic made a syntax error, or forgot to put an
    argument, but cloneNode
    indeed *does* work in IE, which I have proofs for:
    * I use it a lot and have tested it on IE, 6 and 7
    * I used it with exactly the same purpose as yours, for sending a
    file to server, in a hidden form inside
    an iframe, by cloning the visible input type=file into the form and
    then calling submit() on form.
    Search the Internet for references of cloneNode usage, and try to
    debug the script reading through
    error messages. As for cloneNode, once it works in Mozilla, it will
    work in IE. I guarantee.

    Cheers.
    Darko, Nov 7, 2007
    #15
  16. VUNETdotUS

    Darko Guest

    On Nov 8, 1:50 am, Randy Webb <> wrote:
    > Darko said the following on 11/7/2007 6:56 PM:
    >
    > > On Nov 7, 10:47 pm, VUNETdotUS <> wrote:
    > >> On Nov 7, 3:40 pm, VUNETdotUS <> wrote:

    >
    > >>> On Nov 7, 3:28 pm, Darko <> wrote:
    > >>> s0lnic. cloneNode seems to be not browser compatible, doesn't it? I'll
    > >>> try to test now...
    > >>> Thanks.
    > >> Obviously, IE doe snot support. Is anyone familiar with cross browser
    > >> idea for cloning?

    >
    > > Try it harder.

    >
    > You can try it all you want to and IE still isn't going to set the
    > .value property of the file input.
    >
    > > Maybe s0lnic made a syntax error, or forgot to put an argument,
    > > but cloneNode indeed *does* work in IE, which I have proofs for:

    >
    > Nobody said cloneNodes doesn't work in IE. It will *not* set the value
    > of the input though.
    >
    > > * I use it a lot and have tested it on IE, 6 and 7

    >
    > Did you test it with a file input that has a value chosen by the user?
    > Make a test file with an input type="file", use the browser button and
    > choose a file.
    > Use cloneNode to clone the input.
    >
    > Tell us all what the value of that input is. It will be empty.
    >
    > > * I used it with exactly the same purpose as yours, for sending a
    > > file to server, in a hidden form inside an iframe, by cloning the
    > > visible input type=file into the form and then calling submit() on form.

    >
    > Code that does it in IE?
    >
    > > Search the Internet for references of cloneNode usage, and try to
    > > debug the script reading through error messages. As for cloneNode,
    > > once it works in Mozilla, it will work in IE. I guarantee.

    >
    > That I want to see.
    >
    > --
    > Randy
    > Chance Favors The Prepared Mind
    > comp.lang.javascript FAQ -http://jibbering.com/faq/index.html
    > Javascript Best Practices -http://www.JavascriptToolbox.com/bestpractices/


    You were right. I must have confused it with something else I've
    tested with IE :)
    All disregards accepted in advance. Sorry.

    Still, I think it is not any security issue, and I stand behind that.
    If the user
    chose a file in the input field, why would he care if I just let
    another field do it.
    If the answer is "we might trick him", than we might trick him with a
    single field as well.
    To conclude, if a user agrees to send a file to the server, then it
    doesn't matter if I send
    it using another form, the way I see it. From that aspect, it's only a
    bug in IE, not Mozilla.
    The way I see it.

    Darko
    Darko, Nov 8, 2007
    #16
  17. VUNETdotUS

    SAM Guest

    SAM, Nov 8, 2007
    #17
  18. VUNETdotUS

    Darko Guest

    On Nov 8, 1:36 pm, SAM <>
    wrote:
    > Darko a écrit :
    >
    > > As for cloneNode, once it works in Mozilla, it will
    > > work in IE. I guarantee.

    >
    > Hu ?
    >
    > http://stephane.moriaux.pagesperso-orange.fr/truc/innerHTML_danger
    > with tests for innerHTML and cloneNode
    > to try with IE *and* compliant browsers
    >
    > results are a little different ... !
    >
    > --
    > sm


    Look at my last post. I admitted Randy Webb was right about not being
    able to successfully
    clone the file input. Your quoting my "I guarantee" section doesn't
    make me feel good
    about my self :)

    But, cloning itself indeed does work with Internet Explorer, it just
    doesn't copy the object's
    value, too, as Webb already said, when input type=file is object of
    cloning.
    The cloning itself, however, works and the link you've provided should
    work in IE.
    Darko, Nov 8, 2007
    #18
  19. VUNETdotUS

    VUNETdotUS Guest

    On Nov 8, 9:52 am, Darko <> wrote:
    > On Nov 8, 1:36 pm, SAM <>
    > wrote:
    >
    > > Darko a écrit :

    >
    > > > As for cloneNode, once it works in Mozilla, it will
    > > > work in IE. I guarantee.

    >
    > > Hu ?

    >
    > >http://stephane.moriaux.pagesperso-orange.fr/truc/innerHTML_danger
    > > with tests for innerHTML and cloneNode
    > > to try with IE *and* compliant browsers

    >
    > > results are a little different ... !

    >
    > > --
    > > sm

    >
    > Look at my last post. I admitted Randy Webb was right about not being
    > able to successfully
    > clone the file input. Your quoting my "I guarantee" section doesn't
    > make me feel good
    > about my self :)
    >
    > But, cloning itself indeed does work with Internet Explorer, it just
    > doesn't copy the object's
    > value, too, as Webb already said, when input type=file is object of
    > cloning.
    > The cloning itself, however, works and the link you've provided should
    > work in IE.


    The solution is ready! As genius, as simple... May not be the most
    perfect but may work for me fine.
    So, instead of copying or cloning, I'd just use that object itself and
    append it to a new form:

    <input onchange="doit(this)">
    function doit(obj){
    var go = new dothat(obj);
    }
    function dothat(obj){
    //code is a sample........
    var input = obj
    this.form = document.createElemet("form")
    this.form.appendChild(input)
    //...........
    this.form.submit()
    }

    Note: the input disappears from the page, but I would hide it anyway
    because I do not need it. I can replace with loading progress image
    and then a link when the file is uploaded.
    What do you think? Would this cause any issues?
    Thanks
    VUNETdotUS, Nov 8, 2007
    #19
  20. VUNETdotUS

    SAM Guest

    Darko a écrit :
    > On Nov 8, 1:36 pm, SAM <>
    > wrote:
    >>
    >> http://stephane.moriaux.pagesperso-orange.fr/truc/innerHTML_danger
    >> with tests for innerHTML and cloneNode
    >> to try with IE *and* compliant browsers
    >>
    >> results are a little different ... !


    > Your quoting my "I guarantee" section doesn't
    > make me feel good about my self :)


    Ha! bon! OK ;-)

    > But, cloning itself indeed does work with Internet Explorer, it just
    > doesn't copy the object's
    > value, too, as Webb already said, when input type=file is object of
    > cloning.


    I didn't try with a filed file input.
    (in Firefox for instance)
    Usually when I clone a node, this node is a referent hidden one and if
    it is a form's field it's empty. This way no problem with IE.

    > The cloning itself, however, works and the link you've provided should
    > work in IE.


    Ho! Yes, IE can clone a node, but ...
    .... with certain limits we have to know.

    That just was the object of my post.

    --
    sm
    SAM, Nov 8, 2007
    #20
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Alex
    Replies:
    2
    Views:
    1,195
  2. Replies:
    26
    Views:
    2,075
    Roland Pibinger
    Sep 1, 2006
  3. NotGiven
    Replies:
    3
    Views:
    324
    Michael D. Kersey
    May 13, 2004
  4. NotGiven
    Replies:
    3
    Views:
    284
    Michael D. Kersey
    May 13, 2004
  5. jr
    Replies:
    3
    Views:
    390
Loading...

Share This Page