Re:Should HTML have a “max file size” attribute for input ty...
by Acconut on Friday June 19, 2015 @03:01PM
(#9746920)
No, I do not think this should be implemented. The proper way (in addition to server-side validation, of course) is to utilize JavaScript in order to verify the file's size. This solution also allows different maximum sizes for different file types as one example in the discussion shows. Using JavaScript also adds additional flexibility when trying to achieve custom error messages.
In general, I think the HTML specification is getting quite bloated these days, but this is not the place to discuss this.
Re:Should HTML have a “max file size” attribute for input ty...
by BinaryIdiot on Friday June 19, 2015 @02:05PM
(#9746557)
I'm not sure this attribute makes sense. Yes you can specify a set of types to only allow but this is then used in the file system's native browser to simply filter files out and it clearly shows the user what it's looking for.
For file size there is no interface that shows you what your limit or acceptable range is. In this case how do you notify the user they're trying to upload more than they should? Do we then tie modals / messages to the file input to handle the cases where a user selects something too big?
At least right now you can handle all of this via JavaScript. I think that may make sense to continue versus adding additional attributes.
Re:Should HTML have a “max file size” attribute for input ty...
by gkoberger on Friday June 19, 2015 @01:48PM
(#9746465)
None of HTML's new form attributes replace server side validation (which is annoying since you end up repeating code and having slight differences), however it's a good start.
With CORS and CSRF tokens, it would cut down on accidental issues – which for most sites is a bigger deal than malicious activity.
Re:Should HTML have a “max file size” attribute for input ty...
by duskwuff on Friday June 19, 2015 @01:53PM
(#9746494)
In that sense, it'd be a perfect analogue to the "maxlength" attribute on text inputs. (In fact, I wonder if it'd be sufficient to just make that attribute apply to file inputs as well...)
For file size there is no interface that shows you what your limit or acceptable range is. In this case how do you notify the user they're trying to upload more than they should? Do we then tie modals / messages to the file input to handle the cases where a user selects something too big?
At least right now you can handle all of this via JavaScript. I think that may make sense to continue versus adding additional attributes.
With CORS and CSRF tokens, it would cut down on accidental issues – which for most sites is a bigger deal than malicious activity.
You just know some less-than-stellar web developer is going to use it and not use any proper server-side validation.