How to securely upload file in Edge or Chrome using Classic ASP without extensions or IE Mode - file-upload

I have a Classic ASP application that allows the user to upload a file which is then saved to a network location. The problem is that the current versions of Edge and Chrome have instituted security measures that now prevent the file upload to work correctly without using IE Mode (in Edge) or an extension (in Chrome) that bypass the modern browser security functionality. I am currently using the code as seen in How to upload files with asp-classic, which does work, but only if I bypass the security by using IE Mode or the Chrome extension.
I need to modify the ASP page in some way to allow for file uploads. I have found some mention of using ADODB Stream objects but I am not sure how this would be implemented or if it would solve my problem.
Any suggestions would be appreciated.

Related

Firefox Ignores Content-Disposition

I'm trying to write MVC endpoint that will optionally set the content-disposition to inline or attachment in order to either display the file (a pdf) inside a new browser tab or else to download it. The UI allows the user to select how they'd like to open the file (not my design - can't change that aspect of it).
Note that this works in Chrome/Edge just as expected.
In Firefox, the application settings for PDF appear to trump the content-disposition. Is there a reliable way to get Firefox to respect the content-disposition? Preferably a way that will work w/ a vanilla installation of the browser such that end-users don't need to make any modifications on their end for it to work.
Here's the code I'm using to setup my response (class is derived from ApiController):
var response = Request.CreateResponse(System.Net.HttpStatusCode.OK);
response.Content = new PushStreamContent((stream, content, context) =>
{
dispatcher.Dispatch(request, stream);
}, new MediaTypeHeaderValue(MediaTypeNames.Application.Pdf));
response.Content.Headers.ContentDisposition = new ContentDispositionHeaderValue(contentDisposition)
{
FileName = $"{auto_generated_fileName}.pdf",
};
response.Headers.CacheControl = new CacheControlHeaderValue()
{
NoCache = true,
NoStore = true
};
return response;
We have noticed this issue in our webapp as well. The webapp has a download button that lets the user download a PDF file. Firefox shows the PDF file in the current tab, which effectively kills the webapp.
After a bit of research, this appears to be an intentional feature, see the release notes for Firefox 98:
When you set an application to open files of a specific type in your Firefox preference settings, those files will open automatically, even files served by the website with "content-disposition: attachment". The same applies to PDF files that are set to open in Firefox by default. This is a fix to bug 453455.
Personally, while I can understand some users may want this for web pages that don't behave well, this is an issue for well-behaved web apps.
Setting the download attribute on the anchor does not appear to work either, Firefox still shows the file inline (tested with Firefox 99.0)
So as far as I am aware, you cannot force the browser to download the file if the browser does not allow it. Other web apps such as OwnCloud or Google Drive are having the same issue -- if you click right on a PDF file in Google Drive and then click on Dowload, Firefox still open the PDF file inline, whereas Chrome downloads it.
For now, it seems the best you can do is to open file in a new tab, to prevent the webapp or web page from being replaced by the downloaded file (which is also what Google Drive seems to be doing). You can open the download in a new tab or window e.g. via the target attribute on an <a> links or via the formtarget atttribute on a <button> element.
I found #blutorange's answer after trying to find a solution to the same problem as OP. However, just before I got here, I stumbled across this answer from back in 2013 - https://stackoverflow.com/a/16515146 which suggests to set the Content-Type header to application/octet-stream, instead of application/pdf.
I tried that solution and what do you know - it works! The PDF opens in a new tab in Firefox automatically, but at least it doesn't replace the tab of my application, so yay! Chrome doesn't seem to mind it either and my PDF viewer on my computer also recognizes the files as PDFs.
Now, this might not be the most "correct" fix to the issue we're facing, but it's an alternative to forcing open a new tab.

App has dynamic JS files, unable to debug in Safari Remote Web Inspector

I have a sapui5 app that I'm trying to test on mobile Safari using remote web inspector. Since it loads javascript files dynamically (uses MVC), it only lists these files under XHR. Apparently, because it's XHR, I can't add a breakpoint to these files.
Is there any way for me to debug this? Or force web inspector to load these files some place else? It seems a bit useless otherwise.
I have the latest version of iOS and Safari on my iPad.
I know this question has been asked previously but nobody answered it. So I'm hoping this one will gain a bit more traction.
Thanks!

Create/embed Firefox/Chrome base browser in Visual Studio

Im creating a freeware application (long live the free community) and I'm trying to add various features that might drive people to use the application such as implementing whatsapp web https://web.whatsapp.com/ into the app so that the user will always have an "always on top" window with their chats rather than everytime having to switch tabs if they're multitasking on their browser.
The problem i am having is that the built in Browser control with VS 2013 does not work with whatsapp web and i get the option to use supported browsers like firefox...chrome...safari.
Is there anyway to make a VB.NET application open an actual chrome/firefox based browser within itself?
I found an article on Gecko Browser...I am not sure if web.whatsapp.com would see this as a firefox browser: http://www.vbforums.com/showthread.php?692005-Mozilla-Firefox-Gecko-Xulrunner-in-VB-NET-%28versions-14-and-up%29
Help appreciated.

IE 10 not using AppCache after browser closed

I wrote an application using the HTML5 Cache Manifest and I'm having a problem using it in IE 10.
I used Fiddler to witness the manifest file being downloaded and all resources fetched on the initial load of the application. If I disable my network adapter to force the machine offline, the application continues to work as expected as long as I don't close the browser window.
However, when I close the browser window, then attempt to re-open the page from a favorite, IE 10 tells me "You're not connected to a network". Obviously I know that, I'm trying to use the app offline. These exact steps work in Chrome.
Is this behavior by design? Is there a workaround? I can't test with IE 11 right now...is this different in IE 11?
Hearing of some issues of the appcache clearing if your company utilizes gpo settings and has "empty temporary internet files folder when browser is closed" enabled.
Did you find the answer to this? I have the same problem. I did get a bit further though. I found that if you go to the IE10 File menu option and tick Work Offline then try and access your cached app it loads the page but I still have an issue as it does not appear to be using the javascript file that should also be cached. All works ok on Google Chrome but our clients are restricted to IE so Chrome is not an option.

How to make dojo work offline

I have a project that loads http://ajax.googleapis.com/ajax/libs/dojo/1.3.2/dojo/dojo.xd.js, I want to be able use this project offline
I tried to download dojo.xd.js and link to it locally but this still doesn't work offline
In firebug, on the net tab I can see that there are a lot more .js files that load
Is there a simple way of making this work offline?
The way of integration depends on your way of using it.
I assume you have webserver running locally (without inet access)?!
At the dojo website there are several ways of dojo integration available. Just download one of them (do not use CDN) and put the file on your local web server. Then it is available through the local url (can be relative to your site).
If you wan't to build an "offline" app without a webserver then take a look at Adobe AIR and interation of the dojo toolkit with Dojo Extensions for Adobe AIR.
Another option might be the integration together with PhoneGap or Cordova to build an offline App, e.g. for an IPhone etc. with HTML/Javascript. Win8/RT Applications for the M$ AppStore does support HTML/Javascript, too (have not tested this with Dojo).
Keep in mind there are also some security restrictions (e.g. loading and execution of JavaScript) if you plan to "release" your app as simple html file (click to open in browser).