[whatwg] Embedding images within editable content

On Mon, Dec 22, 2008 at 1:33 PM, Martin Atkins <mart at degeneration.co.uk> wrote:
> However, I'm not sure what the solution is here. If contentEditable was a
> "real" form widget you could imagine it supporting a multipart/form-data
> upload of all of its contained images, or something. However, as long as
> client-side code is manually shifting the data to and from real widgets it's
> not clear how to do this since you can't just create a file-upload control
> with the filename pre-populated and submit it transparently.

You can't create a file input with the filename pre-filled for obvious
security reasons, but you *can* still do some clever stuff here.  In
order to add a picture you'll probably need them to go through a file
dialog anyway to select the picture, and you can make this *actually*
be the file dialog of a hidden file input.  You can then move this
input around in the DOM without clearing its value, and submit it
transparently.

It's a bit hacky, but hey, web security is Serious Business.

~TJ

Received on Monday, 22 December 2008 11:39:49 UTC