File upload widget?

[Lukáš Fryč]

As Michal mentioned on the team meeting, we are not able to hook into
XMLHttpRequest object that we need to make client-side progress tracking
work.

We did a bit of research with Brian yesteday and found out that there is no
other library that would do what we want to achieve, so we can't really get
inspired elsewhere.

Note: the only such implementation is PrimeFaces but they don't use
standard JSF AJAX (jsf.ajax.request function), they use jQuery.ajax



If we look into implementation of jsf.js, XMLHttpRequest (XHR) is not
really exposed anywhere, not even on onevent('begin') [1].

I believe it would be significant improvement to expose XHR instance used
to drive given JSF AJAX request here, that's why I will fill
JAVASERVERFACES (and MyFaces) issue

Fortunately, there is a way how to hook into XHR instance itself - it is
possible to intercept XHR.open method [2] by overriding its declaration.
That's also the approach that we use in Graphene [3] (the impl there is
actually more powerful than we need here).

Even though, Graphene implementation is proven to work cross-browser:
* IE8+ (IE7 and less is not worth the trouble)
* Firefox, Chrome, Safari
* Opera support unknown




The idea is that we can:

1. override a XHR.open method just before jsf.ajax.request
2. wait for call to XHR.open and store reference to the invoked XHR instance
3. override a XHR.open method back just after jsf.ajax.request method

These steps should be performed in a try {} catch {} block and if we do not
succeed to obtain XHR instance this way, we should perform fallback to show
progress bar that reflects "uploading" and "upload completed" states.

There are two possible places for overriding:
1. richfaces.js intercepts calls to jsf.ajax.request already [5]
2. in fileupload.js [6] - note: I'm not sure whether we should do
submitForm here, we may use RichFaces.ajax / jsf.ajax.request


~ Lukas


[1]
https://github.com/jboss/mohttp://stackoverflow.com/questions/629671/how-can-i-intercept-xmlhttprequests-from-a-greasemonkey-scriptjarra/blob/2.2.5-jbossorg-3/jsf-api/src/main/resources/jsf.js#L1958
[2]
http://stackoverflow.com/questions/629671/how-can-i-intercept-xmlhttprequests-from-a-greasemonkey-script
[3]
https://github.com/arquillian/arquillian-graphene/blob/master/impl/src/main/javascript/Graphene.xhrInterception.js
[4] http://www.w3schools.com/browsers/browsers_explorer.asp
[5]
https://github.com/richfaces/richfaces/blob/master/framework/src/main/resources/META-INF/resources/org.richfaces/richfaces.js#L583
[6]
https://github.com/richfaces/richfaces/blob/master/framework/src/main/resources/META-INF/resources/org.richfaces/input/fileUpload/fileupload.js#L252


On Thu, Feb 13, 2014 at 3:55 PM, Lukáš Fryč <lukas.fryc at gmail.com> wrote:

> We need to check all the criteria that file upload defines on both,
> server-side and client-side.
> Otherwise an "attacker" could bypass the criteria by modifying client-side
> code.
>
>
> On Thu, Feb 13, 2014 at 3:14 PM, Michal Petrov <
> richfaces-dev at lists.jboss.org> wrote:
>
>> {quote:modifiedtitle=true|class=jive_text_macro jive_macro_quote}
>> ad) new widget
>>
>>
>>
>> we might want to do more rigorous search for alternative widgets.
>>
>>
>>
>> Let's collect requirements here:
>>
>>
>>
>>
>> *
>> drag-drop
>>
>>
>> *
>> progress indication
>>
>>
>> *
>> file size limits
>>
>>
>> *
>> rejection per file / mime-type
>>
>>
>>
>>
>>
>> (practically all things original widget had, just client-side)
>> {quote}
>> I will take a look but those requirements do not seem hard to implement
>> if we needed to. Drop support in particular is just a listener for drop
>> event and can be easily added to the current fileUpload.
>>
>> Concerning the server side what are the requirements past sending the
>> files to a servlet, are we letting the user handle it?
>>
>> Posted by forums
>> Original post: https://community.jboss.org/message/857511#857511
>> _______________________________________________
>> richfaces-dev mailing list
>> richfaces-dev at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/richfaces-dev
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/richfaces-dev/attachments/20140220/040cd060/attachment-0001.html