jolly
05-03-2001, 05:34 AM
I want to uplad the files from browser to the server with servlet can anyone tell me how to do it.
Or from where can i find the servlet code for this.
Or from where can i find the servlet code for this.
![]() | View Full Version : file upload from browser jolly 05-03-2001, 05:34 AM I want to uplad the files from browser to the server with servlet can anyone tell me how to do it. Or from where can i find the servlet code for this. (SH)Saeed 05-03-2001, 05:54 AM Here's a Perl/CGI script that I have wrriten that will take care of this process. You will need 2 files (one HTML and one CGI): Add this to your HTML file <form name="form1" ENCTYPE="multipart/form-data" action="upload.cgi" method="POST"> <font face="Arial, Helvetica, sans-serif" size="2">File:</font> <input type="file" name="file"> <br> <br> <input type="submit" name="Submit" value="Upload File!"> </form> Now save this code as "upload.cgi" and put it in the same directory #!/usr/bin/perl use CGI; #Full path to the directory where you want the files to be saved. Do not end with "/" $basedir = "/home/sites/site1/web"; #URL to go to after the file is updated (include "http://") $url = "http://www.domain.com/directory/"; # DO NOT EDIT BELOW HERE ######################################################### $ref = new CGI; $fileName = $ref->param("file"); $fileName =~ s/^.*(\\|\/)//; $umask = umask; umask(000); open (OUTFILE, ">$basedir/$fileName") || error("Could not create file: $!"); while ($bytesread = read($file, $buffer, 1024)) { print OUTFILE $buffer; } close (OUTFILE); umask($umask); print "Location: $url\n\n"; sub error { print "Content-type: text/html\n\n"; print @_; exit; } Change the $basedir and $url to fit your needs and then you're set. Enjoy.. Tarin 05-03-2001, 07:29 AM That CGI script has a potentially large security problem. It's not filtering input aggressively enough. That perl 'magic open' thing is highly dangerous -- it often will interpret shell codes (and thus run remote commands), and will certainly honor '../'. It will also follow links and clobber things, if it has permissions. Remote commands probably won't happen in this case, but _always_ _always_ _ALWAYS_ check your input, and _always_ use sysopen with the O_EXCL flag if possible. Especially when using stuff like 'system' or 'open' that sucks in potentially untrusted input. die 'Invalid characters' unless ($fileName =~ /^[A-Z,a-z,0-9]$/); sysopen(OUTFILE, "$basedir/$fileName", O_WRONLY|O_CREAT|O_EXCL); Also, make sure to get all of the sysopen definitions with: use Fcntl; You'll probably need to modify this some, but read 'man perlopentut' for more information. (SH)Saeed 05-03-2001, 12:16 PM That script works just fine and I actually did motify it a little so it would be simple. You can simply add a little function to make it check for the file extension so you can only allow certain files. I also removed the filesize check. As you can see it will also remove all "../", the user is trying to upload to another directory. |