I think it is important to understand how file upload works, so to prevent yourself from troubles in the future...
For security reasons, the following applies:
- Browsers cannot access the file system unless the user has explicitly clicked on an upload field.
- Browser has minimal access to the file being uploaded, in particular - you JS code may be able to see the file name (the browser has to display it in the field), but nothing else (the path itself on most browsers is not the correct one).
The upload process itself happens in these steps:
- The user clicks on an upload field, initiating the file select dialog.
- The browser implements access to the file system through the dialog, allowing the user to select a file.
- Upon
OK
click, the browser sends the file to the server.
- The server places the file in its
temp
directory (configured per server).
- Once upload is complete, the upload script on the server is called with the file details, and that script will have full access to the uploaded file.
The last step is the only point where you have full access to the file details, including the real actual name, its size, and its content.
Anything the browser gives javascript is browser depended. Even the file name will vary between browsers although all the browsers I know do keep the actual file name (but not the real actual path), you cannot rely on this to work with future versions. The reason for this is that the file name is displayed on the client side.
So the recommendation is this:
Do all file upload checks on the server side.
Again, you may get away with the file name on the JS client side, particularly if you know and can test what browsers your clients will use, but I'd strongly recommend to to this test on the server.
The last thing you have to remember is that users might upload a file ending with .png
, but the file itself is a .zip
with the extension changed - so to really confirm that the file is .png
you need to actually look into the file data, which only the server can do.