After all what I’ve read on this topic, I know that there is no way to do automated file upload from browser without some kind of “elevated permissions”.
But, elevated permissions is something what I have, bacause the application runs on intranet and user currently enables access to ActiveX control that makes it possible to do some document scanning using COM. Then a scanned document saved on file system needs to be uploaded.
Now, the only browser requirement is IE7+ compatibility. But with IE8, the only way to set value to <input type="file" ... /> is manually clicking “browse” button.
Is there really no way to set value to input form field, even if the site is added to trusted sites and full access for ActiveX code is enabled?
The same seems to apply to Flash and Silverlight, security policy makes it impossible to upload file without user manually selecting it. Silverlight probably could do it in OOB mode, but that is way too interruptive if a user has to click to enable out of browser mode every time.
ActiveX and Java applet could probably do it. If using <input type="file" ... /> is not an option, is there any lightweight (possibly free/open-source) ActiveX control that would handle uploading from file system?
update
I did investigated all the options quite in depth back there, and it turned out it’s the paradigm of security model which makes it impossible to do automated file upload from the browser without user interaction. That means the use must either manually interact to upload file or confirm some ActiveX control or similar plugin to do that job. If you manage to find a way to upload without some special plugin with elevated permissions, you probably found a security hole, which will be fixed soon. However, that’s the way web brower technologies are designed to work.
As Jesse pointed out, there are trust and license issues with third party ActiveX controls.
You’re correct that RIAs like Flash, Silverlight, and Java won’t allow this for security reasons, and that a Silverlight OOB trusted app would technically work, but doesn’t sound ideal.
Since you’re basically looking for a component that will poke a hole in the web security model, I doubt you’ll find many good off-the-shelf components for this (and if you do, I’d be suspicious of them from a security point of view).
I’d suggest writing your own ActiveX control for this, but be sure to think through the security implications. For example, you’d probably want to make sure this control can only be used by trusted websites on your company’s network — this is sometimes called “site locking”.
Here’s a good page on writing secure ActiveX controls: http://msdn.microsoft.com/en-us/library/bb250471(VS.85).aspx