From: JamesBritt <james@...>
Date: 2002-09-19T10:23:52+09:00
Subject: RE: Semi-OT: Web issues


> Difficulties:
>
> 1. First of all, it won't work if your
> login times out. I'm not even certain
> how it knows you're logged in. With any
> luck, it's some kind of timestamped
> token on the server end. If it's a cookie
> on my end, that would complicate my code.
>
> 2. I started by taking the image-upload
> HTML and stripping it to its bare minimum.
> However: This "bare minimum" doesn't work.
> (Even when I've just logged in via the
> browser.) I tried using Javascript to
> fiddle with the referrer, thinking it
> might be checking that. No luck so far.
> HTML shown below.
>
> Of course, what I'd really like is just
> a little Ruby method that will take a
> local filename and upload it programmatically.
> (I hate that word. But you know what I mean.)
>
> Cheers,
> Hal


Some thoughts:

1) The aspx pages are using session cookies. I tried uploading an image from
an IE-based browser that goes through a proxy filter, and even though I
thought I had everything turned off all filtering, it kept failing.  I tried
again using Mozilla, with no proxy stuff, and it worked fine.  I set Mozilla
to prompt me for cookies, but never saw anything. Odd.  But when I go to
"Managed stored cookies", I find this a cookie named "ASP.NET_SessionId" for
www.cafepress.com

2) The site checks the HTTP_REFERER header.  Harder to test.  You'd have to
spoof this in your code.

I think you need to add cookie handling to your script.  I'd be worried if
anybody could just upload files to a URL without some sort of ID process in
place.  Besides, the HTML you showed doesn't contain any information about
whose pictures are being uploaded, or where they should go, so I think this
is stored in cookies.


James