Hidden file upload

[baza]

Hi I am trying to upload flash files to the webserver using input type file.

the file I am uploading is a flash file and there are two parts to the file, the .swf and .flv

I can upload the files by having two input boxes and then uploading no problem, but I am looking for a way where the user selects the .swf file to upload and the site can upload the .swf and the .flv file at the same time. The files have the same name, so tried to do a substr of the file but the copy method will only upload files that have been passed from a form. The next thing I tried was having a disabled input with a bit of java to fill the input depending on what the user put in the first input. but still nothing.

is there a way of uploading a file without it being passed from a input

thanks in advance

 

[feherke]

Hi

You can not do that for security reasons. Only the files manually selected by the visitor are uploaded. Otherwise your password files would quickly become public information...

Feherke.

http://rootshell.be/~feherke/

 

[baza]

why would the password file be public knowledge

 

[feherke]

Hi

Because any script kiddie who's site you would visit would be able to upload as many file from you machine as many they would find.

Feherke.

http://rootshell.be/~feherke/

 

[baza]

the upload page is a protected admin page that only certain users can access

 

[feherke]

Hi

I say that uploading a file from a machine without the accept of the machine's owner is a security issue. Today there is no browser with such security issue. But even if such browser would let you to accomplish your idea, you would not be happy because the same security issue would make it possible for crackers to get random files from your machine too.

Feherke.

http://rootshell.be/~feherke/

 

[jpadie]

@baza

feherke is, of course, absolutely right. this would be a bad security hole.

however it is possible to do what you want with some installed client-side services. a browser toobar might work, or maybe an hta file (only for IE).