Forum:

Servlets

how to restrict user to only to upload excel files?

Sapumal Bandara

Ranch Hand

Posts: 31

I like...

posted 10 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Guys I created a JSP to upload excel files to a server. But It still seems to be letting any type of file to be uploaded. Is there a way to do it? following is my JSP.

<%@ page language="java" contentType="text/html; charset=ISO-8859-1"
	pageEncoding="ISO-8859-1"%>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Upload Excel Files</title>
</head>
<body>

<form action="UploadHandler" method="post" enctype="multipart/form-data">
		<br>
		<table border="0">
			<tr>
				<td>Category:</td>
				<td><Select name="categories" id="categories">
						<option value="PVG_MR" selected>PVG_MR</option>
						<option value="BBLG_MR">BBLG_MR</option>
						<option value="FMM_INV">FMM_INV</option>
						<option value="FMM_MR">FMM_MR</option>
						<option value="FMM_MII">FMM_MII</option>
						<option value="LMM_MR">LMM_MR</option>
						<option value="LMM_INV">LMM_INV</option>
						<option value="LMM_PR">LMM_PR</option>
						<option value="LMM_MII">LMM_MII</option>
						<option value="MCM_MR">MCM_MR</option>
						<option value="MCM_INV">MCM_INV</option>
						<option value="MCM_MII">MCM_MII</option>
						<option value="VPM_MR">VPM_MR</option>
						<option value="CSM_PM">CSM_PM</option>
				</Select></td>
			</tr>
			<tr>
				<td></td>
				<td></td>
			</tr>
			<tr>
				<td>Select File to Upload:</td>
				<td><input type="file"
					accept="application/vnd.ms-excel,application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"
					name="fileName">
				</td>
			</tr>
		</table>
		<br> <input type="submit" value="Upload">
	</form>

</body>
</html>

Regards,
Sapumal.

Be you.. not someone else.. in everything you do..

Ulf Dittmer

Rancher

Posts: 43081

posted 10 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

A quick googling suggest that this attribute is not consistently and reliably implemented by browsers (and not all by some widely used versions, like Safari 5 and IE 9).

But regardless of that, you should not rely on the client anyway, and need to implement the check on the server (where it's easy to implement a much more reliable test).

Tim Holloway

Saloon Keeper

Posts: 27807

196

I like...

posted 10 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

You cannot block uploads on the server side based on file type. Neither the file extension nor the upload MIME type can be trusted. Which is one of the ways malware gets in.

The best you can do is to discard the uploaded data if you disapprove of it.

One reason you can't block the upload is that (barring "chunked" transmissions), the data is actually part of the total form upload data packet, not something transferred independently the way that images are. So by the time you know what's arriving, it's already there.

The secret of how to be miserable is to constantly expect things are going to happen the way that they are "supposed" to happen.

You can have faith, which carries the understanding that you may be disappointed. Then there's being a willfully-blind idiot, which virtually guarantees it.

Sapumal Bandara

Ranch Hand

Posts: 31

I like...

posted 10 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Thanks for the advice guys.. So should it be done in my servlet or somewhere else? I mean using a java script or something like that?

Regards,
Sapumal.

Be you.. not someone else.. in everything you do..

Bear Bibeault

Sheriff

Posts: 67747

173

I like...