RE: File uploads

[Tim Pushor]

Title: Message

No, that is not my real concern, but more a realization that I don't have any code that runs prior to *something* downloading the file for me.

 

What I really want is to be able to tell download time without using any gross javascript hacks :)

-----Original Message-----
From: John D. Leonard II [mailto:[EMAIL PROTECTED]]
Sent: Monday, January 21, 2002 1:56 PM
To: [EMAIL PROTECTED]
Subject: RE: File uploads

Tim:

 

It sounds like you are concerned with someone playing with LWP and forcing a "POST" response to a file on your server.  Is this your concern?

 

This kind of attack can occur on any web page, not just Apache::ASP files.  There is probably some Apache settings to allow file uploads only to specific directories.  Joshua?

 

JL

-----Original Message-----
From: Tim Pushor [mailto:[EMAIL PROTECTED]]
Sent: Monday, January 21, 2002 3:47 PM
To: [EMAIL PROTECTED]
Subject: RE: File uploads

That's what I was afraid of.

 

So then, whats to stop someone from uploading files at *any* of my ASP documents? webserver permission?

-----Original Message-----
From: John D. Leonard II [mailto:[EMAIL PROTECTED]]
Sent: Monday, January 21, 2002 1:38 PM
To: 'Tim Pushor'; [EMAIL PROTECTED]
Subject: RE: File uploads

Tim:

 

I believe that the file upload occurs BEFORE any Apache::ASP processing takes place.  Here is a description of the entire transaction.

 

1) The server presents the form to the browser.

 

2) The user presses the "select file" button to pick their local file.

 

3) The user presses the "Submit" button on the form.

 

4) The broswer sends the form responses (including the contents of the local file) to the server.

 

5) The server decodes the form, see their is a multi-part file attached, and busts the entire thing apart.

 

So - you can record the time between the server presenting the form to the user and the time the user hits the submit button, but that is about it.

 

JL

-----Original Message-----
From: Tim Pushor [mailto:[EMAIL PROTECTED]]
Sent: Monday, January 21, 2002 3:26 PM
To: [EMAIL PROTECTED]
Subject: File uploads

list,

 

I have an application where I would like to time how long it takes to upload a file via HTTP. What I was wondering is where (when) exactly is the file upload taking place? When using tempfiles, when does apache-asp (or CGI.pm) actually transfer the file from the user? I would like to be able to execute some code before it happens - mostly to just record the before-transfer time for comparison later.

 

Is this possible?

 

Thanks,

Tim