Is there a way to get the physical path with Javascript (or any other library) where the user saved the file he/she downloaded from my Web Application?
No, having such a feature would be a security flaw.
Only Google Chrome support the filesystem-API, but i'm not sure if a website can use this Api.
More informations.
No, unless he/she tells you where they saved it, or unless you control the user of the application's computer. This is a silly question if you think about it logically, do you not think there might be few very major security concerns if you were able to very easily spy on the internals of users computers?
Related
We are currently looking at porting a enterprise silverlight application over to html5. The major roadblock that we have hit is the ability to open files from the user's local disk. Currently they have a document library which just links to files on their computer that they can open from within the app and view or print out. All that I read is that you can only access the local sandbox of the web app with the html5 file api's. We want to load these files from code.
Does anyone know of any workarounds to this?
Thanks
There is no way for html5 to access local file without user selection. But FSO: FileSystemObject works for IE and MAYBE could be regarded as a work around. But still there are some requirements to meet.
It is possible to use chrome's filesystem API to access files on a users local filesytem. So you'd have to be willing to make this a chrome only application.
Using java you can create a "Signed" applet which has access to the local filesystem. (if the applet is signed you can request filesystm permissions)
then there is a tutorial for accessing methods of your java code directly from javascript here: http://docs.oracle.com/javase/tutorial/deployment/applet/invokingAppletMethodsFromJavaScript.html
you should be able to perform something similar from silverlight.
There is no workaround in pure HTML5/Javascript. You need the use of plugins, such as Java or Silverlight (maybe you shouldn't port it after all). As for workarounds, HTML5 gives you an easy way drag and drop multiple files that you could transfer on the server and then display back to your users. Another workaround would be to install a custom agent (a software with only a tray icon) that would send the information about the current user "document library" to server and then again, you could display it back to the user.
Note: I've heard somewhere that browsers will eventually stop supporting plugins. http://www.howtogeek.com/179213/why-browser-plug-ins-are-going-away-and-whats-replacing-them/
Ya, I agree with Markain. However, if you were to limit your audience solely to chrome users, I daresay, you would most likely use some of your users. If Huazhihao is right, then your number of leaving customers should decrease but users who regularly use firefox won't be happy. Overall, I think that this will not work. Otherwise, there would be too many websites that trashed your hard driver (or at least wherever you have the rights to edit/delete files). I think it would be best if your product was setup to synchronize the file whenever an internet connection was detected and a change was made to the file. That way the user would not need to visit the website whenever the file was uploaded. If this is some kind of an error file, then it would be most beneficial if you were to make a link in the application that when clicked, would upload the file to the website and the website were to do whatever was necessary. If this is a purely online thing, then I don't see what business you would have looking through other peoples' files =-). Hope I helped!
Please hear me out before you start crying security issues.
This is for an intranet application, hence I have full range to install any plugins or change any security permissions to suit.
What I want is for them to go to a webpage and click a link to download a file, such as a Word Document. This gets transferred to local storage of some kind (sandboxed if need be) and then is opened in word as a regular file.
When they click save, JavaScript or something will pickup the file is saved or the program is no longer accessing it and can be actioned upon, such as uploading back up to the server.
Is there any way to do this. I have looked at IndexedDb, WebStorage, HTML5 FileSystem API but I am new to all and don't see a way to do this.
I am open to coding any needed plugins as long as you don't mention Flash. The main issue I am coming across is opening a file downloaded into some form of local browser and then opening it via a desktop application, e.g. Word.
Any help, greatly appreciated.
After much research the only way to do it is with a plugin. IndexedDB, FileSystem API or WebStorage can not access the local file system. Which is good.
Silverlight is a good option for intranet and .NET, which is what I have chosen to go with.
Silverlight 5 in full permissions with a file watcher. The file watcher can be accomplished with this method: Is there an alternative to accomplishing what the FileSystemWatcher does in Silverlight?
I have to upload one file from client using Button.I have to get the full client path.for example,
suppose, user uploaded a file from this local machines "d:\my files\docs\test.xml".So, now i want to get the same path("d:\my files\docs\test.xml") to proceed further.how do i get it?
i have used FileUpload1.PostedFile.FileName...But it is worked fine with IE and but not in Firefox...
So, Can you help me with this for Firefox and chrome...
Good Source:
http://blogs.msdn.com/b/ie/archive/2008/07/02/ie8-security-part-v-comprehensive-protection.aspx
Checkout the "File Upload Control" section near the bottom. quoted:
Additionally, the “Include local directory path when uploading files”
URLAction has been set to "Disable" for the Internet Zone. This change
prevents leakage of potentially sensitive local file-system
information to the Internet. For instance, rather than submitting the
full path C:\users\ericlaw\documents\secret\image.png, Internet
Explorer 8 will now submit only the filename image.png.
This would suggest it is possible if the site is trusted (in IE) / older browsers
No, it is not possible. Browsers do not allow that due to security restrictions.
If i could set which file I wanted from javascript, a hacker could take a lot of files from your PC.
So, asp.net or otherwise, getting the full client path in a browser is not possible.
http://www.ietf.org/rfc/rfc2184.txt and http://www.ietf.org/rfc/rfc2388.txt seem to be the relevant RFCs that discuss this. They are quite lengthy but what it boils down to is that you do indeed get a filename but not a path.
Browsers will follow these standards so through the standard browser interface there will be no way to get the information you want.
This leaves other techniques such as javascript, flash, silverlight, etc.
Javascript does all of its work through the browser object model so again by default won't help. Anything to do with playing with the file system is considered a security risk (do you want random pages looking through your file system?).
It is possible that you could create your own flash or sliverlight upload tool (or find one) that will allow you to collect richer information, I don't know much about those technologies. At the end of the day though I would expect them to follow similar rules about access to the client computer.
So the RFCs and there spirit which are likely followed everywhere says that no, you can't do this.
You could always ask the user for a path in a textbox though if it is important and just have them copy it in...
There seems to be ways to do it but at the same time it looks like it will only work if it is your machine. Here is a link that explains it.
http://www.codingforums.com/showthread.php?t=72288
The problem occurs because it is seen as a malicious script trying to access information that is not under its control giving the user a prompt. So unless this is for machines under your control or users who trust you then it isn't the best of ideas. Most users who see security risk alerts will always block them.
Is it possible to make a launcher for a website that opens a file installed on your computer published by the website, like a button?
For example, the user can install "blahblah.exe" onto their computer by downloading the installer from the website, and there could be a "Click here to launch blahblah.exe" button on your website, and when you click it, it opens blahblah.exe which was installed previously.
Is it possible?
Can you imagine the potential security and privacy issues this would have if it was possible?
Thankfully, it is not possible, not by default.
With browser plugins this is possible, but you need to install these.
Of course it's possible, but not without either
an exploit for a vulnerability in the user's browser (or other component)
a plugin for a browser that specifically allows that kind of things.
So, in general no.
Special cases are for example:
iTunes which registers an URI handler (so iTunes can launch when you click a special link)
Some other software that includes a launcher as a browser plugin (Skype, iirc)
In both cases something has to be done by the user before it's possible (and that's how it should be, ideally).
Short answer: No, this is not possible.
Longer answer: You could do something with a browser extension, but of course you have to
Write one
Get the user to install it
This isn't allowed due to massive security risks. There are plenty of things you can do to an operating system just by running commands, so any malicious page you visit could potentially wipe your entire disk, steal your data or anything else someone might want to do.
It is like giving a robber the key to your front door. Here you go, feel free to start up any random program.
No it is not possible with a standard security settings on the browser. There are ways to do it with ActiveX in IE, but that requires very relaxed settings.
Or you can install some sort of plug-in that can listen for an event and do it.
I want to make it easier for a user to import bookmarks to my server. Is there anyway to automate this process using javascript to obtain the user's bookmarks? I'm assuming the browser has to have this feature - and I'm not sure if any browser does due to the inherent security risk.
Nope, that's not possible for security/privacy reasons. The only way is to ask them explicitly through form input to give you but I don't think you want to do that.
The browser is obviously aware of their bookmarks, but no, JS cannot access this information - it would be leaking private data as you yourself have noted.
Anything you can do in JS with the user's permission can be done without their permission. The only manual control they have is "Run scripts" or "Don't".
As yourself and others have noted, it's not possible because of privacy and security implications.
What you can do however is to import bookmarks from a source (XML, JSON, HTML...). Most browsers have an export bookmarks feature that generates a file. You can parse that to get what you want.
What Sarfraz said, and thank God for it. I don't think users want people on the web to be able to access their bookmarks for any reason.
im a 100 % sure there is no way to do this in js due to the securtity risk, however its probably possible with activex but thats only available on internet explorer