How to prevent FileUpload control from clearing on postback?

Question

I'm having some trouble with the FileUpload control and was wondering if I could get some help.

On my page I have a FileUpload control, and a drop down list.

So the user browses to the file they want, and then select an option from the drop down (which enables some checkboxes that are also on the page for use, depending on what they select in the drop down). This causes the FileUpload control to become empty, and now the user must browse to the file they wanted again.

Is there anyway to prevent the FileUpload control from losing its contents during the PostBack?

Alternative server side implementation(arguably more complicate) is in [Persist FileUpload Control Value](https://stackoverflow.com/questions/18651039/persist-fileupload-control-value) — Michael Freidgeim, May 15 '23 at 08:55

score 9 · Accepted Answer · answered Jul 10 '09 at 19:43

9

Since you tried Relster's suggestion and it didn't work, Spencer is correct. Due to security concerns, it is impossible for anything but the browser to set the path in an <input type="file"/> element. The only solution is to restructure the flow so that the only postback is done when you want to submit the file, and do any other manipulation with client side scripting.

The reason you cannot set the path is because it would allow you to steal users' files. For example, if you hide the input, and have an innocent looking button for postback, you could set the default path of the file input to whatever you wanted to get access to, and the user would upload it without ever knowing what's going on.

answered Jul 10 '09 at 19:43

Sean

4,450
25
22

Thanks, I will certainly be looking at using client side scripting to perform the required changes to the page when the drop down is changed. – Denis Sadowski Jul 10 '09 at 19:47
Doesn't seem like much of a security risk; a user would first have to click the file upload option, select a file, and wait for it to be uploaded. I tend not to select a file for upload on a website unless I *want* the site/page to take the file in the first place. The only 'trick'/'stealing' would be hiding *when* / *whether* the file was uploaded. AFAIK the browser can't automatically harvest files from the computer without first prompting the user to pick something, so "setting the default path" as you describe doesn't pass the smell test. – TylerH May 22 '20 at 18:08
@TylerH I see the problem. User selects to upload cat-picture.jpg. Then clicks on innocuous button. Upload file is changed to the file with the list of all his bank account and credit card numbers. Even supposing the new file name is displayed, would the user even think to look at it before clicking Submit? Maybe and maybe not. Of course the hacker would have to know the path names of sensitive files on your computer, but he could make a good guess by using names from common software products, like popular accounting software, using default install locations. – Jay Aug 02 '22 at 19:19
... Sure, if the user doesn't have that particular app the upload will fail. But hackers don't expect every hack attempt to succeed. They play the odds. – Jay Aug 02 '22 at 19:20
@Jay Ah, yeah that isn't allowed by the browser, but that's not what I thought Sean was talking about; I thought he was referring to the browser changing the *destination* file path. Obviously the browser should not be able to change the *input* file path at all, for the exact reason you mention. – TylerH Aug 02 '22 at 19:33

score 5 · Answer 2 · answered Jul 10 '09 at 19:15

5

So, if I understand correctly, the drop down has the autopostback property set to true and you're checking the value of the drop down to make default changes to the check boxes?

Instead try using client side scripting to do the trick.

answered Jul 10 '09 at 19:15

Spencer Ruport

34,865
12
85
147

Yes the drop down has the AutoPostback property. I thought I put in the actual asp into my post, but I suppose I forgot or it was filtered out of my post. – Denis Sadowski Jul 10 '09 at 19:29
What happens on drop down change event? Is there a major shift in page functionality? – Robert Koritnik Jul 10 '09 at 19:55

Denis Sadowski · Answer 3 · 2009-07-10T20:37:04.437

I will most likely be using client side scripting to fix the issue.

However I've found an solution that makes use of ajax for those people who might be interested.

http://forums.asp.net/t/1125781.aspx

From the post by Jessica Cao, which also contains a code example:

"... you could use AJAX to make asynchronous postback to the server, make the partial page which contains the DropDownList to postback, and the page contains the FileUpload control won't postback, so the FileUpload will maintain the FilePath."

This method requires the use of System.Web.Extensions.dll, and as a result the .Net 3.5 Framework.

score 1 · Answer 4 · answered Jul 10 '09 at 19:52

Whenever there's a postback you have to check whether there was also a file coming from the client and save it. You won't be able to re-fill the input box on the client though. I suggest you better hide file upload control (unless you allow multiple file upload) and display filename with check mark beside it. Similar to GMail when you upload files to your email message.

Reasons are security concerns as other pointed out.

I'd also disable any auto postbacks because a drop down change may seem to last an eternity to the client if the upload file size is sufficiently large.

score 1 · Answer 5 · answered Feb 14 '14 at 22:15

1

I wrapped my autopostback controls inside an asp:updatepanel and that took care of it except for validation failure.

answered Feb 14 '14 at 22:15

Maslow

18,464
20
106
193

If you put validator elements (e.g. asp:regularexpressionvalidator) inside the updatepanel with the input elements they're validating, you shouldn't have any issue with validation. – TylerH May 22 '20 at 18:20

score 1 · Answer 6 · edited May 22 '20 at 18:25

The simple solution for preventing file loss from an upload control on postback is to put the upload control outside of an update panel control on a .aspx page. Or, in other words, put all the input controls that might trigger a postback inside an update panel.

eg.

<asp:Content ID="Content2" ContentPlaceHolderID="ContentPlaceHolder1" runat="server">
    <ajax:ToolkitScriptManager ID="ToolkitScriptManager1" runat="server"></ajax:ToolkitScriptManager>
    <table>
        <tr>
            <td>
                <asp:UpdatePanel runat="server" ID="Up_LeaveDetails" UpdateMode="Always">                                 
                    <ContentTemplate>
                        <asp:DropDownList ID="DDl_LeaveType" runat="server" CssClass="textfield" Width="150" AutoPostBack="true" OnSelectedIndexChanged="DDl_LeaveType_SelectedIndexChanged">
                        </asp:DropDownList>
                    </ContentTemplate>
                 </asp:UpdatePanel>
            </td>
            <td>
                <asp:FileUpload ID="UploadCertificate" runat="server" />
            </td>
        </tr>
    </table>
</asp:Content>

score 0 · Answer 7 · edited May 22 '20 at 18:20

0

You can't do this. A simple solution would be to move to an Ajax file control.

edited May 22 '20 at 18:20

TylerH

20,799
66
75
101

answered May 18 '10 at 15:46

Nilang

1

How to prevent FileUpload control from clearing on postback?

7 Answers7

Linked