views:

127

answers:

5

Hello all,

I would like to know the paths of certain files that a user is about to upload using my form. I know this isn't allowed using JavaScript for secruity reasons but the system I am building is an internal one for staff. Is there maybe a JavaScript certificate or something that I can place on our servers to say that I can do this? In the same way as Flash allows for a Policy file.

I had a quick google and could not find anything like the above. What are my options? I mean how can I get the paths of the file soon to be uploaded, I will take any sort of implementation idea to overcome this. If I can't find a solution then what I am trying to build is well and truly buggered!

I thought of asking users to upload a text file that contains these paths, but this isn't exactly user friendly.

Thanks all

A: 

JavaScript was designed this way for a reason. It prevents remote systems from snooping on the user. Doing otherwise would be a serious security problem.

If you really need to see the local file system you will have to use Java.

Diodeus
Please note: I have said this is an internal system for the staff.
Abs
That does not change the facts.
Diodeus
The reason I commented the above was to let you know I am aware of the reason why file-paths are not left out in the open, as I said in my question.
Abs
A: 

Maybe you can with a browser extension. You con overcome lots of restrictions from XUL in Firefox

Victor
This might be an option, but then I will have to impose a restriction on staff to only use the FF browser.
Abs
You can do extensions for IE as well, and I guess for Opera and eventually for Chrome, but that would be opening another can of worms, I see your point...
Victor
Yes, I would like the problem solved but not to that extent. Thank you for the suggestion, at least I have options now.
Abs
+1  A: 

You can get the path to be uploaded just fine, but you cannot change it...

var fil = document.getElementById("FileUpload1");
alert(fil.value); // will show file name
Josh Stodola
It will only show filename, not file path, right?
Abs
@Abs: that depends. See the MSDN docs for a possible solution for IE: http://msdn.microsoft.com/en-us/library/ms535128(VS.85).aspx
NickFitz
I see, so on low security it works - just tried Blakewell's answer and I am sure Josh's will work now. Hmm, this might be the best solution, unless someone comes up with another idea! This one will work but then its an extra fact staff have to remember to do...
Abs
@Abs: you should be able to specify that security setting for the Intranet zone in your Group Security Policy via Active Directory,or something like that - I'm not a Windows sysadmin, but I know that this kind of setting change should be deployed from a central location, rather than getting individuals to change it.
NickFitz
Something to consider: I am not 100% certain, but I believe a posted file only includes the file name (not the path). So what you can do is, on your form submit event, you can grab the file value with Javascript and blow it into a hidden field to be submitted to the server.
Josh Stodola
The problem is there is no way to reference that value (the full path) in all browsers.
Abs
I understand that, but accept that this is as good as it gets.
Josh Stodola
A: 

Why not open an OpenDialog box? This works well with IE, which you may be able to dictate since you are working internally.

<html>
<head>
<script>
function attachFile(){
  document.forms[0]['file'].click();
  document.getElementById("FileOP").innerHTML += "<br />"+document.forms[0]['file'].value;
  return;
}
</script>
</head>
<body>
<form style="margin: 0px; padding: 0px;">
<input type="file" name="file" style="display: none" />
</form>

<a href="javascript:attachFile()">Attach File</a>
<br />
<div id="FileOP">
</div>
</body>
</html>
Blake Blackwell
For me this returned "C:\fakepath\test.php"? On IE8, Windows Vista.
Abs
Did you "Allow Blocked Content"? You can create your page as a "trusted site" to ignore this message once you get past this issue.
Blake Blackwell
Also, what file did you select? If you selected "test.php" than that is what the OpenFileDialog would resolve to.
Blake Blackwell
A: 

If you are open to browser extensions you might want to see if Google Gears would allow to do this. Its available for most browsers and platforms.

Craig