views:

309

answers:

1

When an uploaded file is received by the Django server, its name can be read using UploadedFile.name

If filename in the multipart-data content contains a path like: '/a/b/c', UploadedFile.name seems to contain '/c' . How can I retrieve the full path and not just the file name.

Thanks.

Laurent Luce

+6  A: 

You can't. Many browsers won't ever send the whole path, as a security measure to prevent information leakage.

What's more you know nothing about the file and path naming conventions in force on the user's computer, so there is little you can do with the submitted name. Don't do anything that relies on a submitted filename.

bobince
+1: This is an extension of the rule: don't trust *anything* the user sends you. UN*X has a command called `file` which will give you a good idea of what you actually have; I believe there is an API for it. If you're accepting all sorts of random upload stuff you might want to look into 'typing' the file yourself and not depending on the extension.
Peter Rowell