Iframe file uploading and NoScript plugin

Question

I have a form with ajax file uploading. Javascript creates iframe with a form, moves input with the file into the form and submit the form.

This works without any problem, but popular NoScript plugin in Firefox thinks that it's XSS and turn my POST request into GET. So it doesn't work. Is there any possibility to circumvent this problem?

Code (uses jQuery)

function add_input_file(div) {
  var input = $("<input>").attr("type", "file").attr("name", "file");
  input.appendTo(div);
  input.change(function() {
    $(this).off();
    var iframe = $("<iframe>");
    iframe.appendTo($("body"));
    iframe.load(function() {
      $(this).off();
      var input = $(this).data("input");
      var form = $("<form>").attr("method", "post").attr("action", "/send").attr("enctype", "multipart/form-data").attr("accept-charset", "UTF-8");
      form.appendTo($(this).contents().find("body"));
      input.appendTo(form);
      add_input_file($("#att"));
      form.submit();
    });
  });
}
$(function() {
  add_input_file($("#att"));
})

Rather than creating the IFrame and Form dynamically have them as part of the page's HTML <iframe id="ajaxpost" class="hidden" src="ajaxpost.htm" /> — Louis Ricci
– Louis Ricci, Commented Dec 9, 2011 at 12:55
The problem is there can be different numbers of uploading files. So I have to make iframes dynamically. — Ximik
– Ximik, Commented Dec 10, 2011 at 0:38
Did you try setting a source for the iframe? Currently it doesn't have one, so noscript might considers it cross-site because the src of the iframe isn't pointing to the same site. — AVee
– AVee, Commented Dec 14, 2011 at 12:19
@Ximik This code would not work at all with NoScript, what with this code being java- script and all... so there isn't a solution to your problem that still gives you a dynamic multi-uploader. You need scripts for that, and NoScript is blocking scripts. — Chris Baker
– Chris Baker, Commented Dec 14, 2011 at 15:46

Stéphane Bebrone · Accepted Answer · 2011-12-07 21:45:36Z

2

+50

That's not a code fix but I use this jQuery form plugin to do ajax uploading. I've tested the sample with Firefox and NoScript installed, everything ran fine.

If you don't want to use a custom plugin, take a look to the source code to see how it's done.

answered Dec 7, 2011 at 21:45

Stéphane Bebrone

2,76317 silver badges19 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Ximik Over a year ago

This plugin uses special futures of HTML5. And so it doesn't work in old browsers (for old browsers it uses iframe just like my code).

Stéphane Bebrone Over a year ago

Did you try it? Maybe they do something just a little bit different to make it works with old browsers as well.

Ximik Over a year ago

In fact my code is somehow based on this plugin. I've just removed all that uses javascript file access instead of iframe.

Eric Yin · Accepted Answer · 2011-12-14 06:37:12Z

0

I suggest you display a simple file form at <noscript>, since script has been turnned off, you cannot solve the problem by use more scripts.

answered Dec 14, 2011 at 6:37

Eric Yin

8,99921 gold badges82 silver badges123 bronze badges

Collectives™ on Stack Overflow

Iframe file uploading and NoScript plugin

2 Answers 2

3 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related