How do I read this IFRAME's hidden input value

[szlamany]

I'm using jQuery to build an IFRAME and pass some hidden input values to a Download.aspx page - jQuery code looks like this

$('<form action="'+ url +'" method="'+ (method||'post') + '" target="iframeX">'+inputs+'</form>')
          .appendTo('body').submit().remove();

The inputs variable looks like this

<input type="hidden" name="filename" value="mit-license.txt" />

And the top of the Download.aspx code behind looks like this

    Protected Sub Page_Load(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Load
        Dim ctx As HttpContext = HttpContext.Current
        Dim response As HttpResponse = ctx.Response
        Dim sFile As String = "mit-license.txt" ' Request.QueryString("filename").ToString

        ' Buffer to read 10K bytes in chunk:
        Dim buffer(10000) As Byte

        ' Length of the file:
        Dim length As Integer

        ' Total bytes to read:
        Dim dataToRead As Long

        ' Identify the file to download including its path.
        Dim filepath As String = "D:\ACS Desktop\AWC\" + sFile

I could not find the INPUT value - where does it pass in? I checked the "sender" and the ctx objects and could not find it...

I hardwired the mit-license.txt filename to prove that the download works...

[gep13]

Hello,

In your download page, you should be able to use the "Form" collection to get the value you want. See the documentation here:

http://msdn.microsoft.com/en-us/libr...uest.form.aspx

Hope that helps!

Gary

[szlamany]

Thank you!

?Request.Form(0)
"mit-license.txt"

Is that value as easy for a user to see as a QUERY string in an address bar? Or is it reasonable "secure" by the fact that it's buried down a bit. It's obviously in the POST.

Also - I don't see the POST in FIREBUG like other ones - actually I see this 404 error - I believe it's intentional

if(url && data){ 
    // remove old iframe if has 
    if($("#iframeX")) $("#iframeX").remove(); 
    // creater new iframe 
    iframeX= $('<iframe src="[removed]false;" name="iframeX" id="iframeX"></iframe>').appendTo('body').hide(); 
    if($.browser.msie){ 
        downloadInterval = setInterval(function(){ 
            // if loading then readyState is “loading” else readyState is “interactive” 
            if(iframeX&& iframeX[0].readyState !=="loading"){ 
                callback(); 
                clearInterval(downloadInterval);
            }
        }, 23); 
    } else { 
        iframeX.load(function(){ 
            callback(); 
        });
    }

Because of the src="[removed]false. What would be the purpose of that? Are my users going to see ERROR messages in the browser task bar??

[gep13]

Hello,

Using form variables and posting them to the page is definitely far more secure than doing it over the QueryString, and far harder to intercept.

If am confused by this:

iframe src="[removed]false;"

Is this code that you have created, or something that was generated? If the former, what exactly are you trying to do here?

Gary

[szlamany]

It's supposed to do an AJAX-like download without refreshing the page itself

The whole function looks like this - I'm just trying to figure out how to get it working - I did not write it.

$.download = function(url, data, method, callback){ 
    var inputs = ''; 
    var iframeX; 
    var downloadInterval; 
    if(url && data){ 
        // remove old iframe if has 
        if($("#iframeX")) $("#iframeX").remove(); 
        // creater new iframe 
        iframeX= $('<iframe src="[removed]false;" name="iframeX" id="iframeX"></iframe>').appendTo('body').hide(); 
        if($.browser.msie){ 
            downloadInterval = setInterval(function(){ 
                // if loading then readyState is “loading” else readyState is “interactive” 
                if(iframeX&& iframeX[0].readyState !=="loading"){ 
                    callback(); 
                    clearInterval(downloadInterval);
                }
            }, 23); 
        } else { 
            iframeX.load(function(){ 
                callback(); 
            });
        }
        //split params into form inputs
        var inputs = '';
        jQuery.each(data.split('&'), function() {
            var pair = this.split('=');
            inputs += '<input type="hidden" name="' + pair[0] + '" value="' + pair[1] + '" />';
        });
        //create form to send request 
        $('<form action="'+ url +'" method="'+ (method||'post') + '" target="iframeX">'+inputs+'</form>').appendTo('body').submit().remove();
    };
};

From this blog

http://filamentgroup.com/lab/jquery_...file_downloads

About halfway down you will this "version" of the function and see comments about callbacks and what not - I have not even gotten close to figuring out what they are talking about in that regard.

But ultimately - this is working - I do get a file dialog popup for saving/opening the document without losing the page I am on.

[szlamany]

Why is it doing a GET and a POST? Is the GET required by the fact that the IFRAME is doing a SUBMIT??

And why do I not see this in the CONSOLE tab - but only in the NET tab of FIREBUG?