Using file upload widget

[Wayne C.]

I'm introducing the file upload widget to our Driver/Employee file maintenance program so that we can upload certain documents for our drivers. I've created the directory and a file share for the file. When I click on "Upload" on the Upload widget I get the following error "Operation prevented by exit program". I'm not sure what this means. I've checked and rechecked the syntax of my script for the target directory and everything seems good. I've had a file upload working for our order entry file for a couple of years now and I've modeled the driver document upload after it. So this isn't something new although I haven't gone thru this process for a couple of years. Am I missing or forgetting something? And what is this message telling me? Here's the target directory script I'm using:

script: '/www/puidev/htdocs/profoundui/userdata/images/RDOC/';

Any help would be appreciated. Thanx in advance.

[Scott Klement]

We provide an exit program on the server for security purposes. To understand: Consider what would happen if someone uploaded a new program that replaced a key part of the operating system. They'd be able to take control of your system and do anything they wanted! I'm oversimplifying, it's not that easy to do that on IBM i... but I think you get the idea, it's important to restrict what files someone can upload and replace.

So you have to write an exit program that runs on the server that decides what is and isn't allowed. This is documented here:
http://www.profoundlogic.com/docs/display/PUI/Security

You can simply write code that checks the IFS directory you are uploading to.. If it's the right place, set the "allow' flag to 1 and the exit program will allow it.

If the exit program does not allow it (which is the default), you will get "operation prevented by exit program"

[Wayne C.]

Thanks Scott. I'll take a look into that.

[shuffman]

I have a similar problem except the message just reads "Operation not permitted." when you submit the screen. I checked out the exit program and don't think that is the cause. It works fine on our development system but not on this particular production system.

After typing the previous paragraph i tried doing the upload myself through a VPN and it works so some sort of local security i'm guessing. Have you ever seen this before?

The exit program contains the following:

Code: Select all

If FileInfo.Directory = '/tmp'             
   or FileInfo.Directory = '/tmp/frompc';  
                                           
  Allow = 1;                               
                                           
EndIf;                                     

And attached are the widget properties and the error

[Scott Klement]

"Operation not permitted" is an operating system error that occurs when you do not have authorities to do something in the IFS.

IIRC, the file upload widget writes the uploaded file to a temporary filename in the IFS before sending to your program. Is it possible that the user running the upload does not have enough authority to write the file to the temporary directory?

[Scott Klement]

Nope -- I just looked at the code, and I must've been thinking about something else. It does not use any temporary directory. It simply uploads directly to the directory that you specify on the widget, using the same filename that was specified on the upload, unless you specify "rename to", in which case it uses the "rename to" filename in that directory.

"operation not permitted" would mean that the user uploading the file does not have appropriate authorities to upload a file with that name to that IFS directory.

Also, please remember that adopted authority does not affect IFS files.