On Saturday, October 20, 2018 at 12:01:21 PM UTC-7, @TiddlyTweeter wrote:
>
> The import mechanism allows browsing to find a file to import.
>
> Is it possible to specify an exact address of a file (preferably with 
> relative addressing) so you can just click a button and activate import? 
> I'm not clear if its possible or how to do it if it is.
>

It's no longer possible, due to increases in browser security.  

If you could access an "exact address of a file" without going through the 
system interface, then it would be possible to trick people into clicking a 
button that reads system data without them knowing it.

Basically, the system file I/O dialog box is limited by the browser so it 
can be used to select a file, but the data *returned* by that box only 
includes the filename, extension, and file *content*... but NOT the path to 
the file, as that could be used to probe your local directory structure to 
look for vulnerabilities (at least... that's the theory).

-e

-- 
You received this message because you are subscribed to the Google Groups 
"TiddlyWiki" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
To post to this group, send email to [email protected].
Visit this group at https://groups.google.com/group/tiddlywiki.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/tiddlywiki/6233fd87-391d-4cb5-a602-72816ed754d8%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Reply via email to