Comment 5 for bug 257485

Revision history for this message
Matthew Paul Thomas (mpt) wrote : Re: Can't not attach a file

Firefox and Safari deliberately do not (and IE/Mac did not) let people type or edit the path of a file they're uploading. I don't know if Safari's reasons are public, though Mac OS has always avoided exposing full file paths to humans where practical. But in Firefox's case, at least, it was for security reasons. If the file upload control contains an editable field, there are effectively infinitely many ways in which the control can be made to look like an ordinary text field. And if people can be tricked into typing the path of a sensitive file in that field, they'll upload it without realizing. <https://bugzilla.mozilla.org/show_bug.cgi?id=258875>

Now, you could still say it's a browser bug that browsers don't provide an explicit button for deselecting the file that you've selected, and I'd agree. But I don't know of *any* browser that does that, and even in browsers that let you edit the path field, I don't think that's an obvious method.

So, I suggest that when JavaScript is available, Launchpad should add a "Clear" button next to any file upload control, which would deselect the file in the control. (Possibly the only way to do this would to be to delete the control from the DOM entirely, and insert a new one in the same place with the same id=, name=, and other attributes except for value=.)

Then in five or ten years, if most people using Launchpad use browsers that supply an equivalent button themselves, Launchpad can stop supplying its custom buttons.