File Upload in ASP.NET using HtmlInputFile control

pvasudevan · May 22nd, 2004, 07:22 AM

Hi, I've created a file upload ASP.NET application using C#. I'm using a HtmlInputFile control to upload the file.

When I browse for a file and upload it to a new location, the upload works fine. The file is saved successfully to the new location. All permissions, encryption type are all fine.

The problem that I'm facing is, when I browse the file, rename it in the control and upload it to a new location, the upload still works fine, but is created as a new file. I mean a fresh new file is created with 0 bytes. Instead what I was expecting was that the browsed file be saved to the new location with the renamed file name and with all its content intact. But that is not happening.

I'm using the method: <filecontrol>.PostedFile.SaveAs(<path>).

I tried assigning the posted file to a new HttpPostedFile object, but that doesn't help too.

I will be thankful for any guidance given by the readers.

TIA
Praveen

planoie · May 23rd, 2004, 06:28 AM

What I am understanding you are saying is that you change the name of the file on the page before you post it? As in, you select a file (from Browse...) and then you manually edit the file name in that input box? If this is the case, then this is the problem. If you change the filename how does the browser know what file to upload? It is basing the file it is sending to the server on that input box. If you change the name of the file and that file doesn't exist on the client machine, then what can it send? 0 Bytes.

The solution might be to provide a "Rename file:" input box so you can type the new name that the server will use to save the file (or save and rename if you have to).

Peter
-------------------------
Work smarter, not harder

melvik · May 23rd, 2004, 11:20 PM

This is a sample witch works fine, HTH.

Code:

<%@ Page debug="true" %>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" >
<HTML>
  <HEAD>
        <title>::: UPLOAD SAMPLE ::: </title>
        <script language="c#" runat="server"> 

            void Page_Load(Object sender, EventArgs e) 
            {
                if (Page.IsPostBack)
                    SaveImages();
            }

            System.Boolean SaveImages()
            {
            System.Web.HttpFileCollection colFiles = System.Web.HttpContext.Current.Request.Files; 
            System.Text.StringBuilder strMessage;
            strMessage = new System.Text.StringBuilder("Files Uploaded:<br><br>");
            System.Int32 intFileCntr;

            try 
            {

                for (intFileCntr = 0; intFileCntr < colFiles.Count; intFileCntr++)
                {

                    System.Web.HttpPostedFile objCurrentFile = colFiles.Get(intFileCntr); 
                    System.String strCurrentFileName;
                    System.String strCurrentFileExtension; 

                    strCurrentFileName = System.IO.Path.GetFileName(objCurrentFile.FileName); 

                    if(strCurrentFileName != "")
                    { 

                        strCurrentFileExtension = System.IO.Path.GetExtension(strCurrentFileName); 

                        if (strCurrentFileExtension == ".gif" || strCurrentFileExtension == ".jpg")
                        {
                            objCurrentFile.SaveAs(Server.MapPath("books\\") + strCurrentFileName); 

                            strMessage.Append(strCurrentFileName + " successfully uploaded.<BR>"); 
                        }
                        else
                        {
                            strMessage.Append(strCurrentFileName + " failed!! Only .gif and .jpg images allowed! <BR>"); 
                        } 
                    } 
                } 

                Label1.Text = strMessage.ToString(); 
                return true; 
            }
            catch (System.Exception Ex)
            { 
                Label1.Text = Ex.Message; 
                return false; 
            }
            }

        </script>
</HEAD>
    <body>
        <center>
            <form id="UPLOAD" method="post" encType="multipart/form-data" runat="server">
                <h3>Multiple File Upload Example</h3>
                <P><INPUT id="File1" type="file" size="50" name="File1" runat="server"></P>
                <P><INPUT id="File2" type="file" size="50" name="File2" runat="server"></P>
                <P><INPUT id="File3" type="file" size="50" name="File3" runat="server"></P>
                <P><INPUT id="File4" type="file" size="50" name="File4" runat="server"></P>
                <P><INPUT id="File5" type="file" size="50" name="File5" runat="server"></P>
                <P><STRONG>:: </STRONG>
                    <asp:linkbutton id="LinkButton1" runat="server" Font-Size="XX-Small" Font-Bold="True" Font-Names="Verdana">Upload Images</asp:linkbutton><STRONG>::
                    </STRONG><A id="LinkButton2" style="FONT-WEIGHT: bold; FONT-SIZE: xx-small; FONT-FAMILY: verdana" href="java script:document.forms[0].reset()">
                        Reset Form</A> <STRONG>::</STRONG></P>
<P><asp:label id="Label1" runat="server" Font-Size="XX-Small" Font-Bold="True" Font-Names="verdana" BorderColor="White" BorderStyle="None" Width="400px"></asp:label></P>
<P>
<asp:Label id=Label2 runat="server">Label</asp:Label></P>
<P>
<asp:Label id=Label3 runat="server">Label</asp:Label></P>
            </form>
        </center>
    </body>
</HTML>

Always:),
Hovik Melkomian.

krp · June 30th, 2004, 06:45 AM

Hi
I would like to be able to upload a file without a user needing to browse or type anything at the client. The client ASP.NET page knows the path of the file that is to be uploaded, but for some wierd reason there is no way to assign this to the value property of HtmlInputFile: it just can't be assigned to! Is there any other way of uploading that doesn't involve HtmlInputFile class?
Thanks
Keith

Imar · June 30th, 2004, 06:54 AM

That is a security issue. Consider the following example to see what I mean:

Code:

<html>
<head>
  <script type="text/javascript">
    function DoSubmit()
    {
      document.forms[0].submit();
    }
  </script>
</head>
<body onload="DoSubmit();">
  <form name="frmSubmit" action="StealMyDoc.aspx">
    <input type="file" name="txtFile" value="C:\My Documents\MySecretFile.doc" />
  </form>
</body>
</html>

If you think about this for a while, I think you'll be glad this isn't possible.....

Cheers,

Imar
---------------------------------------
Imar Spaanjaars
Everyone is unique, except for me.

Hal Levy · June 30th, 2004, 07:02 AM

No tif your trying to write a .pwl stealer :)

Hal Levy
Web Developer, PDI Inc.

NOT a Wiley/Wrox Employee

krp · June 30th, 2004, 08:04 AM

Hi,
Thanks for the explanation. But surely there must be some way around this for use in a trusted environment.

Has anybody got any suggestions?

Thanks
Keith

planoie · June 30th, 2004, 08:20 AM

Never trust HTTP.

Of course, if you are in a trusted environment (like an intranet/ office LAN), then you more than likely have direct access to the actual user's machine. So why not have the server make a network file request to the user's computer? The server variables will contain the user's IP address, so you could just make a request to their machine directly (in theory at least). That may sound absurd, but isn't that basically what you are asking for?

melvik · June 30th, 2004, 08:44 AM

Well, I got u wanna code to upload.
So if u dont wanna make a Upload form for user, there r some Software like CuteFTP.
or use ur [u]Host Control Panel</u> to upload ur files.

HTH, & keep in touch in any faced problem.

Always:),
Hovik Melkomian.

Hal Levy · June 30th, 2004, 11:56 AM

You could write your own Client Side program that has rights to the drive and have the user install that. It can probably do what you want.

Or, you could just have them browse to it..

Hal Levy
Web Developer, PDI Inc.

NOT a Wiley/Wrox Employee