W32Upload
Version 1.01  -  may 14, 2001

Home page: http://www.delphicity.com

 

 


package install

1. unzip the archive in a folder of your choice (e.g. c:\w32upload)


2. create the following directories under your server wwwroot directory:

/cgi-bin directory that will receive the cgi program and the parameters file
/incoming directory that will receive file uploads
/upldhtml directory that will receive the W32Upload html dialog pages

NB: when you have successfully tested W32Upload, you can place the W32Upload files
in any directories of your choice, after doing some adjustments. See the "Moving W32Upload files" section in the user guide.


3. Copy the archives files to the directories created above as follow:

cgi-bin\w32upload.cgi cgi program
cgi-bin\w32upload871432.ini parameters file required by the cgi program
upldhtml\upldlogin.htm login page
upldhtml\upldform.htm upload file page
upldhtml\uplddone.htm "upload succeeded" page
upldhtml\upldfail.htm "upload failed" page


4. The following tasks below require access to the Web server management. If you are not the WebMaster contact him to do that for you:

- in the "root directory" tab of your "Web server" properties, check at the bottom of the tab if guests are allowed to run programs and not only to execute scripts. Otherwise enable them to run programs,

- add the "Write" right and REMOVE the "List" right on the "incoming" directory from the Web Guest user named in IIS "IUSR_your_computer_name",

- if you plan to use authentication, setup a system DSN to your database (if it is not already done). See the ini section.


Using W32Upload without authentication

Authentication is disabled if the "auth_connection_string" in the .ini file does not exist, is commented or left to blank.

Calling http://www.your_web_server.com/cgi-bin/w32upload.cgi displays directly the upload form.

"Pre-flight" check list: (see package install):
- package install done and all the files copied as explained,
- permission given to run program in the properties of the the web server,
- "write" permission given in the "incoming" directory to "IUSR_your_computer_name".

If all these conditions have been met, simply try to upload a file as follow:

- run your browser,
- enter in the address bar: http://www.your_web_server.com/cgi-bin/w32upload.cgi,
- choose the file to upload,
- press the "UPLOAD" button to upload the file.

You should get either a page displaying that the upload is done and the file should be placed in the incoming directory, either a page displaying that the upload failed with the error status. If something goes wrong see the TroubleShooting section.


Using W32Upload with authentication

Authentication is enabled if the "auth_connection_string" in the .ini file specifies the DSN connection string, and if all the other "auth_" parameters are correctly filled out.

Calling http://www.your_web_server.com/cgi-bin/w32upload.cgi displays the login form. Enter your user and password. W32Upload authenticates you through the DSN ADO connection. On success, the upload form is displayed. On failure, the login form is displayed back.

"Pre-flight" check list: (see package install):
- package install done and all the files copied as explained,
- permission given to run program in the properties of the the web server,
- "write" permission given in the "incoming" directory to "IUSR_your_computer_name",
- ODBC DSN connection set and parameters filled out in the .ini file.

If all these conditions have been met, simply try to upload a file as follow:

- run your browser,
- enter in the address bar: http://www.your_web_server.com/cgi-bin/w32upload.cgi,
- enter your login and password, press the "Login" button.
- on success the upload form appears: choose the file to upload, then press the "UPLOAD" button to upload the file.

You should get either a page displaying that the upload is done and the file should be placed in the incoming directory, either a page displaying that the upload failed with the error status. If something goes wrong see the TroubleShooting section.


Html dialogs pages customization

For an easy integration of W32Upload in you site design, the dialogs are not "hard written" in the program, but W32Upload loads required html dialogs pages from any directory. You can easily customize them.

WARNING: These pages contain "replaceable" text fields, prefixed by "(w32upload_", e.g. "(w32upload_UserId)". Some of these fields are placed in hidden input fields, not visible on the displayed page. Be careful not to delete them when editing the html pages, otherwise W32Upload could have some troubles at run time. Although, you can delete the visible replaceable fields if you do not plan to display them (like filename, error status, etc...).

upldhtml\upldlogin.htm login page
This page is displayed if authentication is enabled, before displaying the upload page.
upldhtml\upldform.htm upload page
This page is used to select the file to upload, then to submit it to WS32Upload.
upldhtml\uplddone.htm "upload succeeded" page
This page is displayed on upload success.
upldhtml\upldfail.htm "upload failed" page
This page is displayed on upload failure.

You can use another html page instead of upldform.htm to submit the file. Simply copy the form structure from the upldform.htm page to your page, then call http://www.your_server.com/your_page.htm instead of http://www.your_server.com/cgi-bin/w32upload.cgi.
Be careful not to delete the hidden input fields contained in the form.


INI file

The INI file contains the W32Upload necessary parameters. It must be placed in the w32upload.cgi directory.

For security reasons, the ini filename is different for each W32Upload registered product. The ini filename is made of "w32upload" + the 6 digits of the W32Upload registration number. E.g.: if the name of the cgi file is "w32upload" and the registration number is 871432, then the ini file name is "w32upload871432.ini".
Of course, the "List" right must be disabled on the w32upload.cgi directory, otherwise users will be able to browse the directory and see the ini filename.

If you plan to use several upload forms with different parameters, simply copy the w32upload.cgi as a new filename (e.g. upldjpg.cgi) and copy the ini file according to the new cgi name (e.g. upldjpg871432.ini).

The INI files parameters are the following:

path_incoming: the path where are stored the files uploaded by W32Upload. E.g.:

path_incoming = incoming


overwrite_if_exist: the action performed if a file with the same name exists in the "path_incoming" directory. The possible values are:
0: existing file not overwritten, upload aborted
1: existing file overwritten, upload successful
2: file renamed, upload successful
    e.g. if existing file="name", new file= "name1";
    if existing file="name1", new file= "name2"; etc...
E.g.:
overwrite_if_exist = 1


html_formlogin, html_formupload,  html_onsuccess, html_onfailure: path\name of the pages used by the W32Upload dialogs, starting from the wwwroot directory (use "\" and not "/"). The default values are:

html_formlogin  = upldhtml\upldlogin.htm
html_formupload = upldhtml\upldform.htm
html_onsuccess  = upldhtml\uplddone.htm
html_onfailure  = upldhtml\upldfail.htm

max_file_size: maximum size allowed for a file uploaded (default value).
- at upload time, if the file size is greater the upload is cancelled.
- there is no size limit if this parameter is omitted or commented.

allow:  filetype[, size]: only the specified file type is allowed. Add several lines to allow several types. Optionally specify a different size limit for each type. E.g.:
allow = htm, 20k
allow = mpg, 1M
allow = txt
- if there is no allow parameter (or if they are commented), all the file types are allowed, otherwise only the file types declared are allowed.
- for a given type, if the file size is omitted the max_file_size is applied.
- the file size may be specified in bytes, Kb or Mb (add k or M).
- 'mpeg' is automatically interpreted as 'mpg', 'jpeg' as 'jpg', 'html' as 'htm' (create only jpg, mpg and/or htm lines).

auth_connection_string: this is the ODBC connection string. If omitted or commented or blank, authentication is disabled. Else specify the connection string. FOR SECURITY REASONS, YOU SHOULD CREATE A DSN ALIAS and only specify the DSN name, e.g.: auth_connection_string="DSN=DbSite", instead or giving the full connection string with DB user and password.

auth_account_tablename: the name of the table of the DSN database containing the users accounts. This parameter is used in the SQL "SELECT" statement to check authentication. E.g.: auth_account_tablename="Account"

auth_account_userfield: the name of the field of the auth_account_tablename table containing the user name. This parameter is used in the SQL "SELECT" statement to check authentication. E.g.: auth_account_userfield="user"

auth_account_passfield: the name of the field of the auth_account_tablename table containing the user's password. This parameter is used in the SQL "SELECT" statement to check authentication. E.g.: auth_account_passfield="password"

auth_login_expiration: the delay in seconds after which the upload page displayed on successful authentication expires. E.g.: auth_login_expiration=30

auth_prefix_filename_with_user: 0 or 1. If 1, the name of the uploaded file is prefixed with the user name. This allows to associate uploaded files and users names. E.g.: auth_prefix_filename_with_user=1

msg_...: you can customize all the W32Upload messages. Simply replace the defaults texts by yours.


Handling more than 1 cgi form

You to create a copy of the w32upload.cgi file (e.g. myupld.cgi) with different parameters to handle several uploads forms from the same web site. See the INI section for ini filename rules.


Security considerations

Allowing your web site visitors to upload files is not innocent. If the right are not correctly given on the cgi and incoming directories, you could have quickly some troubles with your web site administrator, and if you are the administrator some troubles with your visitors...

Discarding these security problems is easy and requires only to apply a few rules:

If not specified, we talk about the rights given at the IIS "guest" user, named  IUSR_your_computer_name (e.g.: IUSR_SERVER). To modify rights, find the directory concerned with the explorer, right-click on the folder, click on "Properties", and then click on the "Security" tab.

- NEVER give the "Write" right in the w32upload.cgi directory. Someone can overwrite your w32upload.cgi or your ini file.

- NEVER give the "List" or "Browse" right in the incoming directory and the cgi directory. If someone can list the Incoming files, and if the overwrite_if_exist parameter = 1 in the .ini file, (overwrite), he can know the files uploaded and overwrite a file whose he is not the owner.

- use a dedicated incoming directory with at least the "Write" right. Add the "Read" right if you want your cgi to be able to read the file uploaded. Otherwise if you intend to access to the uploaded files with your "Site Administrator" username, the "Write" right is enough.

Generally, remove all the "List" rights from all your web site directories if it is not necessary.


Moving the W32Upload files

You can place the W32Upload files in the directories of your choice:

you plan to move the w32upload.cgi cgi file to another directory:
1. you have to move both the .cgi and the .ini file in the same directory
2. you have to edit the upldlogin.htm and upldform.htm (placed in the upldhtml directory) and replace the action="/cgi-bin/w32upload.cgi" by action="/your_new_directory/w32upload.cgi",
3. check the IUSR_your_computer_name user has not the "Write" right on this directory, ELSE REMOVE IT!

you plan to rename the w32upload.cgi file:
1. rename the w32upload######.ini file as neww32uploadname######.ini
2. execute the step 2 of the previous plan (edit upldlogin.htm and upldform.htm).

you plan to make another directory the "incoming" directory:
1. edit the w32upload######.ini file, and set the "path_incoming" parameter with your new incoming directory,
2. don't forget to set the rights for IUSR_your_computer_name user on this directory: REMOVE "List", add "Write", optionally "Read" if you want your cgi to be able to read the incoming files (see the "Security" chapter).

you plan to move the html dialog pages:
1. edit the w32upload ini file, and set the corresponding parameters according to the new paths.


TroubleShooting

When I call from my browser http://www.your_web_server.com/cgi-bin/w32upload.cgi, I get a single line that says "unable to open file: w32upload######.ini".

The ini file cannot be found. Check if the w32upload######.ini file exists in the w32upload.cgi directory and if ###### is your registration number (e.g. 871432 for the demo version).

When I call from my browser http://www.your_web_server.com/cgi-bin/w32upload.cgi, I get a single line like "form upldhtml\upldform.htm not found".

Check:
- if the upldhtml\*.htm pages of the package are properly installed on your web server (in the /upldhtml directory or any web directory of your choice,
- if the W32Upload######.ini file contains the true path to these files. See the INI section.

I upload the file and I get the error page with the message "file already exists".

Your overwrite_if_exist parameter in the .ini file is set to "0". Set it to "1" (overwrite) or "2" (rename) to allow uploads even if the file exists on the server.

 

Disclaimer

The author of this program accepts no responsibility for damages resulting from the use of this product and make no warranty or representation, either expressed or implied, including but not limited to, any implied warranty of merchantability or fitness for a practical purpose.

This software package is provided here "AS IS", and you the user, assume all risks when using them.


Description - features - registration

DESCRIPTION

W32Upload uploads any files from an html multipart form to W2000/NT servers running  IIS or Apache for Windows.

W32Upload consists in a cgi executable placed in the cgi-bin directory of your web site, and customizable html dialog pages placed in any directory.

Several parameters controls the uploaded files: incoming directory, type filter, size filter, existing files (overwrite or rename).

The html dialog pages (login page, upload form, success of failure reply pages) are external to the cgi and can easily be integrated and customized according to your website design.

Users can be optionally authenticated to your site database through ODBC and DSN.

 

BENEFITS

- saves you to tangle with the multipart-form/data parsing

- upload files of any size to w2000/NT servers running IIS or Apache but not Perl

- control type and size of uploaded files

- authenticate users to YOUR database through ODBC (ADO and DSN)

- easy integration of the W32Upload html dialog pages in your website design

 

SYSTEM REQUIREMENTS

 
  • Windows NT/2000 server
  • Microsoft IIS or Apache for Windows
  • Delphi 4 or 5 (only required to edit source code)
  • Perl not required.

 

REGISTRATION

Click here to register.