Upload a file and get a headache - htmlfile: Access Denied

Question

We have a page that lets users upload a file using the asp:FileUpload control. When the user tries to submit the form the get a client side javascript error "htmlFile: access denied".

This only happens in IE 7 (not sure about 6) and FF is OK.

Apparently this is due to a security setting that was introduced to IE with XP SP2. Fair enough, but how the heck to we get around this? Not every site Ive uploaded to does this so there must be some trick to play nicely with IE.

Ive wasted days on this bug.. am ready to kill something/someone :)

Thanks

Answer 1

I have not seen this error before (don't work with fileupload much).. Can you give us some sample code? Would be interested to see if I can replicate.

Answer 2

The only solution I have discovered it to write custom client side JavaScript to validate the the user didn't enter/choose a relative path. There is a Microsoft KB article about it here.

Answer 3

Jonesie, do you have ANY client side validation on the file field? e.g. are you trying to check if the value is not blank, or is a certain file type?

If so, this is likely the issue. As you noted, IE changed its security policies, and certain interaction with the field is considered "snooping attempt" at which point IE will not allow the upload.

Try removing ANY validation (this includes any onfocus,onblur,onchange event handlers.

Answer 4

Thanks guys. I managed to work back through 20 days of changesets until I found the culprit - an onload event handler on the body tag. Ive blogged about it here: http://jonesie.net.nz/htmlFileAccessDeniedADefenceForMurder.aspx

Cheers