59408 - Full path name of uploaded file not sent

Status: VERIFIED WONTFIX

(Core :: DOM: Core & HTML, defect, P3)

Description

[Henrik Gemal]

If you go to:
http://gemal.dk/browserspy/upload.html
and upload a file fx called c:\temp\adr.ldif
you'll get the following info with Mozilla:
Content-Disposition = form-data; name="upload"; filename="adr.ldif"

But with both Netscape and IE you get the full path to the file:
Content-Disposition = form-data; name="upload"; filename="C:\Temp\adr.ldif"

I'm not 100% sure if it's a bug or not...

Comment 1

[rods (gone)]

Hmmmmmmmmmmm, over to eric for now...

Comment 2

[Eric Pollmann]

Verified that this still exists, and setting a milestone - should be a trivial fix!

Comment 3

[Eric Pollmann]

Attachment: fix (removes GetFilenameWithinPath() + calling code)

Comment 4

[Eric Pollmann]

Will aim for 0.9 since this is a Low Risk(tm).  :)

Comment 5

[rods (gone)]

It looks good, r=rods

Comment 6

[Eric Pollmann]

Fix checked in.  To verify, go the the URL above:
http://gemal.dk/browserspy/upload.html

Click on the Browse... button, and select a file to upload.  Make a note of the
full path that is present in the text field, then click the Upload file... button.

On the next page, the Filename listed should be the full path to the file,
exactly the text you noted before.  Thanks!

Comment 7

[Jesse Ruderman]

Shouldn't that patch have been reviewed by mstoltz before it was checked in?

Comment 8

[Vladimir Ermakov]

verifying on build 2001-05-03-04-trunk

Comment 9

[Eric Pollmann]

Due to the fact that this behaviour was not causing any problems on real world
sites, and it *could* be a security concern to send the full path, I'll be
backing out this change.  Thanks Jesse for pointing out the security concern.

As a second reason, the patch above in fact *was* breaking sites because
previous versions of Netscape on Linux would not send the full path so some
server-side scripts could not deal with the absolute path.  (See bug 83065 for
more information).

Reopening and marking WONTFIX.  This will be backed out in the fix for bug 44464.

Comment 10

[Eric Pollmann]

wontfix

Comment 11

[Vladimir Ermakov]

verifying wontfix

Comment 12

[Boris Zbarsky [:bzbarsky]]

*** Bug 94536 has been marked as a duplicate of this bug. ***

Comment 13

[Boris Zbarsky [:bzbarsky]]

*** Bug 183178 has been marked as a duplicate of this bug. ***

Comment 14

[Boris Zbarsky [:bzbarsky]]

*** Bug 147684 has been marked as a duplicate of this bug. ***

Comment 15

[Boris Zbarsky [:bzbarsky]]

*** Bug 231292 has been marked as a duplicate of this bug. ***

Comment 16

[Asa Dotzler [:asa]]

*** Bug 213077 has been marked as a duplicate of this bug. ***

Comment 17

[Jesse Ruderman]

*** Bug 270429 has been marked as a duplicate of this bug. ***