7

When posting a form with a file upload box using document.forms[0].submit() on ie 9 we get an error that says: SCRIPT5: Access is denied

If I click a few more times it works fine.

As a work around I've caught the error and try a few more times which seems to work just fine.

Is there any explanation on this? The code has worked for years on all the other popular browsers.

The code also works fine in IE9 if the browser is set to IE9 compatibility mode, but that is not something we have general control over.

I've seen references to XMLHTTP being an issue and we do execute a XMLHTTP call but it happens before the button to submit is clicked.

DontVoteMeDown
  • 21,122
  • 10
  • 69
  • 105
Tom Hubbard
  • 15,820
  • 14
  • 59
  • 86

1 Answers1

11

It turns out that the security issue is due to the fact that we were running the file submit code in a pop up window. The pop up window was opened with window.open which had an empty string as the requested page. We then posted a form to that window.

The problem is that the URL of the pop up window is defaults to about:blank when not specified. Apparently about:blank is considered insecure so when the attempt to POST the file back to the originating domain is made the SCRIPT5: Access is denied error arises.

The solution is to use a small stub type of html page to open and then perform the post. Once a file is chosen the FILE post does not see the error and the file makes it up as desired.

Tom Hubbard
  • 15,820
  • 14
  • 59
  • 86
  • 1
    What do you mean by "small stub type"? – djKianoosh Apr 21 '13 at 15:05
  • 1
    @djKianoosh Just a small html file that the browser can call initially before it executes the POST. The one we use has nothing more than the text: Loading..... – Tom Hubbard Apr 22 '13 at 11:45
  • In my case page is not open in popup neither it has empty url – sandeep kale Apr 02 '14 at 12:46
  • @sandeepkale Are you making an HTTP request from a page that was delivered through HTTPS? – Tom Hubbard Apr 02 '14 at 16:29
  • @Tom Hubbard : no, am using simple HTTP request. I did a workaround. I guess it was because I was triggering click of actual file on click of "fake file" field. I shown original file upload and made CSS to overlap the fake one. So as to delegate click event. It worked after it. – sandeep kale May 07 '14 at 08:00