We have a desktop app that allows users to fill in a questionnaire. For certain question types, users can upload files. The desktop app performs the following logic:
- copies the file to a temp location
- reads the bytes from the copy and caches in memory
- uploads all cached bytes when the questionnaire is submitted
It doesn’t take more than five seconds of googling to see that client-side file access from a web app is a security hole. I gather it’s possible if you cripple your security settings but there is no way our IT dept will allow that :).
The requirement that the desktop app logic is designed to fulfil is to not keep the user waiting during the process of filling out indovidual questions. The only wait they experience is at the very end when they hit the “Submit” button. At this point, all questions and files are submitted.
However, after googling, I now think that I will not be able to do offer this in the web version.
So my actual question is: Is there a way to fulfil the requirement of no file transfer until the end of the questionnaire proccess? Can you perhaps create a set of posted files from a set of cached file names? What I need is a way to do a multiple file upload from a set of cached file paths.
But I’m not sure this will be good enough without a copy having been created of the files first….e.g. what happens if the user deletes the file after assigning it to a question but before they submit the questionnaire?
I have looked through all the questions listed as similar to mine but not seen anything that I think I can use. Any tips will be very gratefully appreciated.
You could perform the upload in the background using an iframe. This would alow the user to continue filling in the questionaire as they moved through the process.
You’d have to design your questionaire forms using Ajax correctly though so as not to transition pages whilst the upload(s) were happening.
You’d also have to put a progress bar or something on the final page to ensure all files were uploaded before they closed the browser.