Firefox 3 annoyance: Keying-in disabled in file upload control

[lanux128]

those who have been using Firefox 3 may have noticed this change. Firefox 3 now by default blocks any input on the file upload edit field, instead a file-browse dialog is opened. This makes the text field un-editable and to make matters worse, the devs are proclaiming that this behaviour is to prevent 'exploits'.

there hasn't been much news on this - i did find a blog entry, though.


• http://codangaems.bl...file-upload-box.html

[mouser]

this is totally unacceptable to me -- i need to be able to paste screenshot paths in the file upload box!

[beermatt]

this is totally unacceptable to me -- i need to be able to paste screenshot paths in the file upload box!

-mouser (July 04, 2008, 03:12 AM)

Not convinced this is a big issue - previously you could click on the field and then paste, now you click the field and a file requester opens - but you can still paste the full path of the file you want to upload into the requester (works for me anyway)..

[lanux128]

to each his own but previously i'd just right-click and paste the filename in a single action. now this new behaviour is seriously hindering me since i do a lot of copy-pasting, hence this post.

[justice]

There's bigger things to worry about, but if it's an input box then you should be able to input text, any other input box does. Basic usability. Couldn't find any explanation from the devs though so whether it's a legitimate reasoning or quick hack it's impossible to judge.

[mouser]

Not convinced this is a big issue - previously you could click on the field and then paste, now you click the field and a file requester opens - but you can still paste the full path of the file you want to upload into the requester (works for me anyway)..

ok well that definitely mitigates it down from a showstopper to a minor inconvenience for me.  i still don't like the change but it it does indeed help security i can live with that.  someone will probably come up with a nice plugin to make it act like before anyway.

[jgpaiva]

i still don't like the change but if it does indeed help security i can live with that

-mouser (July 04, 2008, 10:51 AM)

I don't think it's the right attitude to give security as an excuse for cripling software, that should be a last-resource option.
Personaly, i really can't understand why they've done that, and seriously hope Opera doesn't choose to do the same

[Lashiec]

If it's the name of security, at least they could give some explanation of the real possibilities of taking advantage of a possible exploit, this is not the first time that the Mozilla team decides to alter features that come as defaults in the rest of the browsers without giving a proper explanation and/or (what's it's worse) documenting it. While it's nothing that the majority of the users are going to miss, but in a way they're going against stablished standards just for a perceived increase in security.

<insert rant of angry Opera users for removing file extensions in the cache for the new version and access to the shell, without a mention in the changelog>

Personaly, i really can't understand why they've done that, and seriously hope Opera doesn't choose to do the same :(

-jgpaiva (July 04, 2008, 11:36 AM)

Ssssh! Don't give ideas! ;)

[wreckedcarzz]

I have been getting annoyed by this new change as well. I upload stuff to MediaFire.com often and the first time I tried to enter (paste) a file path into the text field w/FF3, it gave me a file dialog box. I thought it was a problem on the MediaFire site.

I don't mind most things that may give a little bump to security, but if your going to do that then make the textboxes that the browser "blocks" into buttons or something... that's like baiting a fish. Except here, I am the fish. And its pissing me off!

[cmpm]

Just cancel the file dialog box and then you can paste the text.
It worked for me anyway.
I think it's an automatic thing, so you don't go putting something in there you don't want to.
But that's just my opinion.

[cmpm]

Hmmm...Sorry, I was mistaken.
I haven't uploaded anything by pasting in the text box in a while.
So the last time I did was probably with 20014.
And also perhaps they thought it was a convenience for that box to pop up. But we should get a choice.

I've also heard that there is a way to get your clipboard contents, if hacked into somehow or way.
Don't know the details.
Maybe that's the security thing.
If they said why then everyone would know I guess.

[lanux128]

if they're going to change the default behaviour, that is fine with me as long as there is an option for users to revert to the previous behaviour. this "we know all" change is a bit Microsft-ish. btw, reminds me of the blog that mouser posted.

[Ehtyar]

I'm sorry to post against such an old thread, but I have only just discovered this myself (I was on holiday when this thread was active), and I'm quite put out by it. Anyone wishing to show support for a fix should sign up and post a comment here.

Ehtyar.

[lanux128]

good work, Ehtyar on the comments at BugZilla. i do wish this would be resolved soon enough.

[Ehtyar]

Thanks lan man, though I don't know what kind of chance we have, so far they seem to feel they have justification for their doing, though that Carl twit hasn't helped....

Ehtyar.