Re: quickform : if not validates, forgets file
| From: | Benjamin | Date: | Wed, 24 May 2006 16:26:08 +0000 |
| Subject: | Re: quickform : if not validates, forgets file | ||
| References: | 1 | Groups: | php.pear.general |
| Request: | Send a blank email to pear-general+get-24140@lists.php.net to get a copy of this message | ||
hallo,
it is consideres a security risk, if input type=file fields have default values. so it is impossible to set such a field to a value. If it would be possible one could try to make a form with a form field the user cannot see, and set it to "/etc/passwd" par example.So the unknowing user would upload his passwd file by submitting this form.
regards benjamin
gema schrieb:
hello, IŽm using HTML_QuickForm and when any element type does not validate, and goes back showing the error message, if the user had uploaded a file, the form does not remember the choosen one as it remembers the other fields that were going on the post. Can anybody tell me why and if there is some walkaround? thanks gema