securitybrowserfile-uploadhttppostedfile

HttpPostedFile.FileName - Different from IE

When I upload a file to a site using the ASP:File control the FileName property is different in IE and Firefox. In Firefox, it just provides the name of the file, but IE provides the full path to the file.

I have worked around this by adding the code:

Dim FileName As String = file.FileName
If FileName.LastIndexOf("\") > 0 Then
    FileName = FileName.Substring(FileName.LastIndexOf("\") + 1)
End If

But I'm not sure why that would be different between the different browsers. Does anyone know the reason for this?

Thanks.

Solution

  • This is a security/privacy concern, firefox/mozilla is doing it right and you will not get a way to get the full path without an add-in, applet, silverlight, flash or some other mechanism.

    Here is more info on Mozilla's stance:

    https://developer.mozilla.org/en/Updating_web_applications_for_Firefox_3

    See the section on Security Changes->File upload fields

    I hope IE will follow suit so we have a consistent and secure environment.