Circumvention of Opera's Upload Field Path Protection

Matthias Reuter — Sun, 20 Dec 2009 22:40:08 +0000

If you have a form with a file upload field, in some browsers you cannot extract the path to the chosen file. This is meant as a security measure, because it might reveal some information about the user, e.g. the username.

In earlier versions of Opera, if you tried to read the upload field's value, only the file name was given:

var uploadField = document.getElementById("upload");

var path = uploadField.value; // was "foo.jpg"

In the recent version, Opera for some reason reveals a full path, but it's a fake path:

var uploadFIeld = document.getElementById("upload");

var path = uploadField.value; // now "C:\fake_path\foo.jpg"

Read more

united-coders.com - Opera

Circumvention of Opera's Upload Field Path Protection