cURL / Mailing Lists / curl-library / Single Mail

curl-library

[patch] use only basename in "filename" attribute in -F post

From: Fedor Karpelevitch <fedor_at_karpelevitch.net>
Date: Mon, 27 Sep 2004 22:11:40 -0700

Hi,

currently curl by default sets "filename" attribute for an uploaded
file to whatever was specified on command line. RFC is not entirely
clear (to me) regarding what exactly should be put in this field, but
browsers I checked (IE, mozilla, konqueror) seem to agree in putting
just the basename of the file there. It makes some sense from
security (information disclosure) stand point as well. The reason I
got to it was that I was trying to use curl to upload files to
http://www.photocheap.biz/ which is using IIS 6 and kept getting 500
errors. I figured that the cause was that I was using full paths to
specify the files and that was being passed in "filename" attributes,
which IIS choked on. Attached is my patch to fix this problem (works
for me). I am not sure it is done right (it's been several years
since I wrote anything in C), but you get the idea at least. Let me
know if this patch can be accepted.

Thanks for a great tool!

Fedor.

  • application/pgp-signature attachment: stored
Received on 2004-09-28