323684 - input type="file" value should be remembered in a history database

Status: RESOLVED WONTFIX

(Toolkit :: Form Manager, enhancement)

Description

[Vincent Lefevre]

User-Agent:       Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8) Gecko/20051111 Firefox/1.5
Build Identifier: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8) Gecko/20051111 Firefox/1.5

Note: this is an enhancement request on a problem mentioned in bug 189978.

On some site (sorry, I can't give the URL), I can submit a file to upload, and if there is an error, the page is redisplayed with values that were previously entered. But the value for input type="file" isn't kept by Firefox. Bug 189978 says that it is for a security reason, and I agree in the general case.

Now, we are here in a particular case: the file has already been submitted by the user, which is some kind of validation. I think that the browser should remember file names and URLs in some history database, and if there is a match, the value proposed in an input type="file" could be kept by the browser (possibly for a limited time).

Reproducible: Always

Comment 1

[Jesse Ruderman]

Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.9a1) Gecko/20060115 Firefox/1.6a1

At least in the bfcache case, WFM.  (I clicked "Create a New Attachment", selected a file, clicked Back, then clicked Forward.)

Comment 2

[Vincent Lefevre]

Note that I wasn't talking about the bfcache, but about a new page with the same URL, something like http://host/cgi-bin/submission with a form, one fills the form, clicks on the Submit button, and the page http://host/cgi-bin/submission is opened again with a new content (pre-filled form and things in red to indicate errors).

Comment 3

[Jesse Ruderman]

An example of where this could be useful is in Bugzilla bug submission.  If you submit a bug report with an extension and one of the CCs is ambiguous, Bugzilla asks you to disambiguate *and* reattach the file.

That said, a better solution for Bugzilla would be to use AJAX and client-side checks to ensure the form is complete and internally consistent before it is submitted.

I'm not convinced this feature would be worth the increased attack surface.

Comment 4

[Justin Dolske [:Dolske]]

I also think this is a risky idea, in terms of attack surface, and generally wouldn't work well since file upload form fields are generally non-editable now, without going through the file picker.

Comment 5

[Vincent Lefevre]

OK, I think I hadn't needed such a feature since I asked for this enhancement. I suppose it is not so useful after all...

Also, concerning file upload form fields, they should be editable if this is requested via CSS (this should be part of bug 237964 resolution, originally bug 322335 for such form fields). So, providing such an enhancement could still make sense in such cases.