dojox.form.FileUploader (flash) doesnt work with some server configuration

[minobun]

On some servers the flash upload fails with http status 403. I dont know the right reason for this. My provider wispered me that the only solution this time is a .htaccess file with the enty:

<IfModule mod_security.c>
  SecFilterEngine Off
  SecFilterScanPOST Off
</IfModule>

And yes this works. So maybe this should be described at:
​http://docs.dojocampus.org/dojox/form/FileUploader

[Mike Wilcox]

The docs have been updated. Thanks for bringing it t0 my attention and offering a fix (they are hard to come by in this case).

You should check out the docs though. I have a link to a page that says that this may be susceptible to SQL injection attacks.

[minobun]

This is not only a https issue. It's also on simple http connections. Ist a bug of adobe flash player in conjunction with the web application firewall (modsecurity). If i understand that correctly the flash player sends one "\n\r" instead but the http protocol requires "\n\r\n\r". For modsecutiry this is a rule break so it delivers 403 rejected.

And yes if you disable modsecurity sql injections can be done on all post vars that are later processed by the database an not escaped within the application. So another safer way - until adobe fixed this problem and all flash players are updated - is the following but may not work on all servers:

<IfModule mod_security.c>
SetEnvIfNoCase Content-Type "^multipart/form-data;" "MODSEC_NOPOSTBUFFERING=Do not buffer file uploads"
</IfModule>

[Mike Wilcox]

Thanks for all the info minobun. I've updated the docs again.

[minobun]

found at: ​http://swfupload.org/forum/generaldiscussion/176