[whatwg] input type="file" value inconsistencies

I'd like the WHAT-WG specs to specify the expected value of a file input
control that has been filled by the user.

The Web-Forms 2 spec says only the filename, not the path, is uploaded to
the server, and this seems to be general browser practice. But what about
the value seen by scripts in the page? IE, Mozilla, and Safari reveal the
full pathname while Opera returns only the filename.

Mozilla has a very old privacy request that we limit the .value to just the
filename as uploaded with the form
(https://bugzilla.mozilla.org/show_bug.cgi?id=143220). We've also gotten
advocacy that we WONTFIX the bug because there are intranet apps that use
the full path value, and in fact don't upload the files themselves they
just use the control as a convenient picker to get the path (they use
script to move those values into a text input control).

Opera's approach is privacy preserving and consistent with the spec for the
uploaded value.

Received on Tuesday, 13 November 2007 23:57:22 UTC