get the full path of a file (Not for upload!)

Question

First of all I apologize if someone already answered this question but i looked for an answer and couldn't find one for my specific question. Here's what i want : I want to get the full path of a file (Local file path), I don't want to upload the file using my asp.net , instead i am using the DropBox API , and it requires the full path of the local file. Locally it works fine (Except for FireFox because for security reason they don't allow that ). But i am able to get the full path with internet explorer and i am using IE 11 just by using this: Form["Fileuploadcontrol"].tostring(). As i said it works for IE but only locally when I deployed it doesn't work and takes the local server path.

Maybe i am not using the right control here , but all i need is a file browser where i can get the full file path.

Once again: I don't want to upload the file , i want to pass the full path to Dropbox API

Also it's not that i have a security issue with my browsers. i can change my settings manually and let my FF and IE bypass the security barrier and get me the full path. instead I am deploying my website which means i can do that for every user using the website.

Answer 1

I took a different route and here's my workaround: - I upload the file(s) temporary to my server (I created a folder called Uploads) - After successful upload , I can get the file path (The one on my server) servername\uploads\filename - Then i pass this path to the dropbox API function dropBoxStorage.UploadFile(srcFile, remoteDirName); - After a succeful upload to DropBox, i delete the temporary file from my server.

I am not sure if it's the best thing to do but it fixed my problem for now.

Answer 2

What i would advise you is:

1) Upload the file on server without full filepath (as passing filepath could be a security issue).
2) Then save the file in your server at a temporary folder (maybe temp).
3) Use the path of temp location on your server to upload file to dropbox.
4) Remove file from temp folder if no longer required

Answer 3

I'm pretty sure you're misunderstanding the security issue. Having a full path is not just an upload security issue, it's a complete javascript security issue. If I could get the full path of the file, I could upload it using Ajax, or any number of ways (http://mywebsite.com/pixel.gif?path=[encodedFilePath]) in addition to uploading the file. So trying to get the filename on the local side should always fail in javascript.

Your only option is to have clients change security settings, or not use javascript.