Web Hosting Talk







View Full Version : file upload from browser


jolly
05-03-2001, 05:34 AM
I want to uplad the files from browser to the server with servlet can anyone tell me how to do it.
Or from where can i find the servlet code for this.

(SH)Saeed
05-03-2001, 05:54 AM
Here's a Perl/CGI script that I have wrriten that will take care of this process. You will need 2 files (one HTML and one CGI):

Add this to your HTML file
<form name="form1" ENCTYPE="multipart/form-data" action="upload.cgi" method="POST">
<font face="Arial, Helvetica, sans-serif" size="2">File:</font>
<input type="file" name="file">
<br>
<br>
<input type="submit" name="Submit" value="Upload File!">
</form>

Now save this code as "upload.cgi" and put it in the same directory
#!/usr/bin/perl
use CGI;

#Full path to the directory where you want the files to be saved. Do not end with "/"
$basedir = "/home/sites/site1/web";

#URL to go to after the file is updated (include "http://")
$url = "http://www.domain.com/directory/";


# DO NOT EDIT BELOW HERE
#########################################################

$ref = new CGI;
$fileName = $ref->param("file");
$fileName =~ s/^.*(\\|\/)//;
$umask = umask; umask(000);
open (OUTFILE, ">$basedir/$fileName") || error("Could not create file: $!");
while ($bytesread = read($file, $buffer, 1024)) {
print OUTFILE $buffer;
}
close (OUTFILE);
umask($umask);

print "Location: $url\n\n";

sub error {
print "Content-type: text/html\n\n";
print @_;
exit;
}

Change the $basedir and $url to fit your needs and then you're set.

Enjoy..

Tarin
05-03-2001, 07:29 AM
That CGI script has a potentially large security problem. It's not filtering input aggressively enough. That perl 'magic open' thing is highly dangerous -- it often will interpret shell codes (and thus run remote commands), and will certainly honor '../'. It will also follow links and clobber things, if it has permissions. Remote commands probably won't happen in this case, but _always_ _always_ _ALWAYS_ check your input, and _always_ use sysopen with the O_EXCL flag if possible. Especially when using stuff like 'system' or 'open' that sucks in potentially untrusted input.

die 'Invalid characters' unless ($fileName =~ /^[A-Z,a-z,0-9]$/);
sysopen(OUTFILE, "$basedir/$fileName", O_WRONLY|O_CREAT|O_EXCL);

Also, make sure to get all of the sysopen definitions with:

use Fcntl;

You'll probably need to modify this some, but read 'man perlopentut' for more information.

(SH)Saeed
05-03-2001, 12:16 PM
That script works just fine and I actually did motify it a little so it would be simple. You can simply add a little function to make it check for the file extension so you can only allow certain files. I also removed the filesize check. As you can see it will also remove all "../", the user is trying to upload to another directory.