Friday, June 20, 2008

Firefox 3's file upload box

Rage. I feel it. I feel the rage.

My problem? Firefox 3's file upload box. What was once a text field for pasting in file paths, plus a button in case you wanted to browse, has changed into one big button. That's right: clicking on the file text field == button click.

First off, it's not a friggin' button. I click a text field, I expect text entry, which means all the stuff that comes with it: cutting, pasting, copying, deleting, modification, the works. No more uploading files with names so similar it's faster to just edit the file names, or tweak the paths.

Second, I can't paste files from my file manager into the box anymore. I'm forced to use the file dialog, which is still inadequate under Linux. I need thumbnails. I need them because my image file names are totally useless. They're useless because they're Unix time stamps. I have hundreds of these time stamped files, so I refuse to name them. Without useful file names they appear as tiny, useless icons under Firefox in Ubuntu, and as even more useless generic file icons with Firefox under Xubuntu. Which was fine so long as I could paste files in from my file manager. But I can't paste files in from the file manager when the text box acts like a button. Without the text box, I'm stuck with the crappy dialog instead. With no way around.

What compelled the developers to do this? Did they think that users wouldn't be able to click a button labeled "Upload"? After having clicked such buttons the whole time they've been on a computer? Did they just not care about people who are faster on the keyboard than they are on the mouse. I'd be real interested in the motivation behind this decision.

Ways to fix this design flaw also welcome, because the only remotely related thing I could find on Google about this was this guy's comments on Firefox Beta 3.

::UPDATE::

dscdood has found some pretty interesting links about this. Read the comments. Turns out this change has been the result of an issue that has been around for a long time.

I still think it's retarded though.

::DOUBLE UPDATE::

Oh, and if the path of your file is longer than the text display, good luck checking if it's right, because you can't select the text field and scroll left or right.

44 comments:

DaVince said...

I agree 100% on your opinion. They shouldn't have changed it, it's become less useful because of their change.

toutomoutochan said...

I wish they had made this a double click, not a single one. I have file uploads where I need to copy the file names to enter in another field (6 files, every single day) and every time I click on the box I get the file upload dialog.

Looking for a Stylish script to change it, but there doesn't seem to be one...yet.

Anonymous said...

I'm encountering the exact same issues. I have folders with a ridiculous number of auto-generated, non-descriptive filenames and having to navigate to the path and drill down for every file takes an order of magnitude longer.

First, if they were going to do this, they should have edited their form display engine to just make it a button and not some fake text field. Also they should have provide the user an option in the about:config to revert to the old behavior.

I did some of research on this and it actually address a valid (but likely very rare) concern, but it could have been fixed by modifying the file input form field's javascript permissions and style properties instead of stepping around the issue by disabling the textbox.

tung said...

> I did some of research on this and it actually address a valid (but likely very rare) concern

Find any good links about it? I'd do it myself, but I'm curious (and lazy).

Anonymous said...

Sure, here are some that I found.

Bug reports bringing up the issue:
https://bugzilla.mozilla.org/show_bug.cgi?id=57770
https://bugzilla.mozilla.org/show_bug.cgi?id=258875
https://bugzilla.mozilla.org/show_bug.cgi?id=56236

demos of possible exploits "fixed" by FF3 (obviously you need to use another browser for them to work):
https://bugzilla.mozilla.org/attachment.cgi?id=17860
https://bugzilla.mozilla.org/attachment.cgi?id=158555
https://bugzilla.mozilla.org/attachment.cgi?id=16863
(these demos are also referenced in the attachments sections of the bug reports above)

The main issue seems to be that a sketchy author could trick people (probably targeting computer novices) to typing or pasting an unintended filename into a file upload box and then with javascript could instantly submit the form (hence uploading whatever file) before the user could change it. I was skeptical that one could "fool" someone into doing that, but they had tricks like using styling on the file upload element to either make it invisible or appear to be a regular text field, and also using hidden characters to have you see one thing and copy/paste something else. However, I'd rather these issues get fixed, even at the expense of style and scripting options, than have a less capable input.

tung said...

Ugh. What really bugs me about this is that the devs won't put an option in for it, because they don't want to be adding options for security holes.

The whole reason I use Firefox is because I can CUSTOMISE it to be USEFUL. This decision basically robs me of that. If I want to rm -rf * Linux doesn't stop me. Maybe that's exactly what I was after. I'm tempted to build Firefox from source, just so I can fix this.

Anonymous said...

I agree entirely, this is extremely irritating. I don't have the problem of folders filled with non-descriptive filenames very much (although I do find myself needing to upload them on occasion), but I can still see those seconds ticking by as I navigate through seven or eight directories deep from a drive's root. (Downside of being very organized, I guess.)

I stumbled upon this post searching for an about:config tweak or something to revert to the old behaviour.

Anonymous said...

Hey, I just discovered something that may be of interest to anyone annoyed by this:

Although the file dialogue appears automatically, it seems possible to type/paste in a full path regardless of its location or the current location in the dialogue itself.

I have personally confirmed this on Windows XP Home SP2 (despite such a thing usually never working in Open dialogues), and have seen it mentioned for the Gnome windowing system.

tung said...

Yeah, from what I read from dscdood's links, the Firefox devs have washed their hands of the usability issue and handed it over to whoever's responsible for the file dialogs.

But as long as it's a separate window, it's always going to take me longer to handle than a simple, bare-bones path box that's already on the screen.

Why do I have to pay for other people's incompetence?

Alex Herrero said...

Irritating? Sure. I didn't realized this before. Thanks for the tip. But you can always paste the absolute path in the common dialog's text field (in win). And yes, you can check what you've pasted just by selecting the text to the right. Not the best solution, but if it works for the inexperienced, I think we "super-users" could always find ourselves some work around, or just get used to it. I remember using a "drag-n-drop" add-on for attaching files in the gmail box. That one may be a good start...

Anonymous said...

This actually poses another significant usability AND functionality issue:
Let's say I picked a file to upload, but oops, turns out I don't need to upload anything.

Well, now what? I can't change the text in the field to be blank.

Am I supposed to create an empty text file or something?

I love FF, but as a developer, rather than a user, this change has me seeing red.
It's all very good for the browser devs to smugly go around saying "This just illustrates why file inputs should not be stylised!", but they need to be looking at the underlying issues of interaction with those inputs, not the design.

Only half the exploits work in IE7, and not a God damned one of them work in Opera. Not even nearly. Opera isn't perfect, by far, but it makes me wonder what the difference is here.

I suspect poor handling of JavaScript plays a fairly big role here.

In the end though, we're going to need the W3C to revisit this issue and make some changes. If not, you're only going to find browser devs taking matters into their own hands (and the handling of these controls in the way mozilla has done is not their business), which leaves the door open for further browser disparity, incompatibility and (looking the track record of certain popular browsers) lack of security.

/sigh

tung said...

Damn, I hadn't even thought of that.

As for W3C, I honestly haven't seen them affect much other than make big documents that describe the common subset of functionality in protocols and formats. Real changes from them? I won't be holding my breath.

Anonymous said...

Agreed. This is really frustrating. I upload 2 images at a time - one a thumbnail, one a photo. The only difference is the path - /thumb/ versus /full/ - it's easier to browse to one, copy, then paste to the other. I can't believe Firefox doesn't let me override their behavior. What happened to FF being the gold standard? I'll use Opera for my photo maintenance from now on. Never thought I'd see the day I chose another browser over FF for any reason other than testing. Shame on them.

Tumbleweeds Jewelry said...

This "new & Improved" feature is so annoying, that I am considering backing-off firefox 3.0 and going back to the previous version of firefox. I have an ecommerce business and I am constantly uploading pictures of products (.jpg files) to my website, to Ebay and other various auction sites. When I can I FTP images rather than using the file upload dialog, I do. But that isn't possible in all cases. This has made the uploading of large numbers of pictures incredibly inefficient and time consuming. I used to cut and paste the file names and increment the auto-generated file names by +1 , etc, etc. ARGH!

Anonymous said...

It completely blows my mind that this STILL has not been addressed in anything resembling even a step BACKWARD!!! I agree with everyone else's sentiments here, though probably more angrily.

Does anyone have any idea how to more highly publicize this issue?? I'm sure there are legions of other file-uploading-nerds who're just as tweaked but since there's no "big" official page for it... no hack to fix Mozilla's "fix" yet :(

For now... all I can think to help is DragDropUpload, http://www.teslacore.it/wiki/index.php?title=DragDropUpload

tung said...

Thanks for the link. There seems to be mixed reports about how well it works under Linux, but I'll try it myself when I get the chance.

Ian Leader said...

I found an addon that adds a 'clear' context menu that allows you clear an individual browse field. Irritatingly, it's experimental, which means you have to log on to addons.mozilla.org to download it - but it does work:

https://addons.mozilla.org/en-US/firefox/addon/7296

Unfortunately I've not found anything that allows you view the whole file path/name so you can check what you're uploading before you do it.

Very frustrating that the 'fix' didn't take these points into account.

tung said...

Cool. Maybe the path viewing problem could be alleviated with an extension that displays a tool-tip showing it.

Still, the change has driven me to simply upload less often. I can't even imagine how frustrating this change would be if I did have to upload many files.

Anonymous said...

This is SO irritating. WHY WHY WHY?! It's made worse by the fact that I'm writing a rather large web application that has been totally held up by this 'custom' behavior by firefox.

Hexadecimal said...

I find the FF3 behavior obnoxious. I am used to copying and pasting paths into the boxes for quick changing.

Anonymous said...

RAGE RAGE RAGE

I *HATE* when new versions come with misfeatures like this.

Anonymous said...

I think this was done to thwart security problems, but it comes with a big defect, which is that once you select a file, you can not then erase that/unselect the file. To me this is a big security problem as well.

Anonymous said...

Ok.. upload file. Right. Oh the wrong one. Just change the last letter, after all I know what a keyboard is. What the...? What the FRACK?! Hell, I'm just not going to upload anything, then. The Hell? There is NO WAY to CLEAR THIS BUTTON? ArrrhHHHGG. SOLID!!!

I'm going to personally eviscerate a few foxes with a bowie knife and stick needles into their still bleeding carcasses praying that whoever came up with that idea gets genital warts.

Yes, I am already under steam because of all the KDE4 chrome "improvements" and the regrettable trend to go "single click" making some mouse operations basically impossible. This will NOT IMPROVE MY MOOD.

Anonymous said...

Well... this unfeature is making me nervous, too. In fact, I consider implementing a Javascript for my sites, which provide a Clear-Button. Bad for somebody, who has turned of JS, but what can I do.

Jesus, why does not have anybody at Mozilla enough common sense to add such a clear button coming along with the file upload box, if they do changes like this.

*let it rain some brain*

Anonymous said...

I consider myself a power user of Windows XP. I use the Copy This Path context menu item to grab paths for pasting into upload fields.

I upload through web pages all of the time. This has been an incredibly annoying change, and disappointed that there is no switch to go back to the older version.

Anonymous said...

I'm a 'Copy this Path' user too and this is seems so stupid and irritating I'm back to using IE..

Anonymous said...

Fuck, the inability to clear that box has been pissing me off, and has led me here. So once I select a file, I have no way of deselecting it? I MUST upload? WTF?!?!

Anonymous said...

I've found a Firefox bug about the current behaviour:

https://bugzilla.mozilla.org/show_bug.cgi?id=374011

Please sign up for their Bugzilla, vote for the bug, and encourage the Mozilla developers to correct this insane regression.

Anonymous said...

Why wouldn't simply disabling paste for a file input field do the trick?

You could still upload sequential files by changing a number, you just couldn't paste into it.

Is that so hard for these jerkoffs to figure out?

(While I'm at it, disabling paste for passwords would not be a bad idea either. The idea that someone might know their password enough to, you know, TYPE it, would certainly NOT hurt.)

Anonymous said...

Holy crap. I never noticed this until today, and I am SO WITH YOU on the rage. I am a web programmer who just finished implementing a simple new file upload for an existing client app and I could not figure out why this mess was happening; I thought it was some kind of a bug. I'm grateful to your blog entry for letting me know it's not something I did, or my designer's jacked-up CSS either.

I bet you twenty dollars that this is going to come back from QA as a bug. "Client cannot clear form field once they have filled it out." It's UNSPEAKABLY lame that my answer is going to be "use another browser." I expect better than this from Firefox.

I'm totally not bringing this up to my PM. Checking it in to version control and hoping I have another job before anyone notices. Jesus.

Anonymous said...

I'm having to return to FF2. I use a local HTML file containing a Javascript binary file editor. FF3 has no way of allowing popups from LOCAL files (it's done by URL), so I've had to disable popup repression altogether.

Furthermore, LOCAL Javascript can no longer access the full pathname from file input controls... only the leafname.

So my own Javascript running on my own computer disconnected from the internet is not allowed to access other files because of "security".

Useless.

Unknown said...

I can happily leave a comment only because FF3 didn't destroy that use case.

I have noticed even if I do use the browse button to choose a file, I see the whole path in the field that I can no longer edit.

How is this more secure ? This is the only ease of workaround if someone needs to upload several files from the same directory, copy and paste. Firefox developers are HUGE FOOLS to defeat copy and paste. Whats next, forcing us to use a dtmf cell phone key pad to punch in a URL ?
I think these guys deserve a beating over the head with a retail box of Netscape 5.

Anonymous said...

This is the worst "improvement" ever. Why can't there be an extension to change the functionality? Too complicated?

chambers said...
This comment has been removed by the author.
chambers said...

UGH! Arg. I share your rage. Your rage amplifies my rage. The DragDropUpload plugin solution worked for only a day. Suddenly it's behaving badly. Everything is against me!

I use multiple upload boxes on one page, a different one for a different purpose. But I can't drag into a specific box anymore. It automatically goes into the very next box in order (if it doesn't already have a link). So frustrating. My work flow is being hindered.

Anonymous said...

As for the developers not wanting to include an option for those who need to manually edit text boxes, maybe you can still petition for an option if your work flow will be greatly accelerated. This is because there are plenty of options already in about:config for security holes, such as Network.enableIDN.

Anonymous said...

As a chantard, this has been one of my most irritating issues with FF3. It makes it extremely uncomfortable to upload an image while using the 'sage' function.

Annoying feature is annoying.

Anonymous said...

I'm trying to upload an image to 4chan, the image I selected was too large but I no longer want to post an image. So HOW IN THE FUCK am I supposed to delete the field? It absolutely won't clear, and since firefox likes to be so fUCKING nifty by saving post form data throughout browsing history, there's no way to get rid of it. This is so messed up.

Anonymous said...

Heh, like the poster above me...simply clicking at the field prompts for file selection. And it utterly annoying that I can't delete it. Course, this seemingly happens on any imageboard.


Really, has there been any solutions to this annoying issue yet?

Anonymous said...

This issue has made firefox USELESS for me. Right now I'm looking for work, which means I'm sending out a lot of resume's. At least I was till firefox automatically updated to v3 on me. Now whenever the "file upload" window opens, firefox freezes up. It doesn't crash. If I wait 25 minutes (I checked once) then it will acknowledge whatever I clicked on. Then if I'm willing to wait another 25 minutes, it will respond to my next command (say, select file?). Then another 25 minutes till it will respond to the next one (for instance, upload).

Now I'm having to use IE to be able to send out the emails, when I shouldn't have to! And the decision that clicking a file input TEXTBOX should automatically open their worthless file upload utility?!?!

Looks like I'm going back to IE since Firfox is no longer a useable browser for me. Thankfully foxmarks is now available for IE now.

Anonymous said...

This should wipe the smug smile off the anti IE brigade for once, but yes, it is v. annoying.

Kill Face said...

Gaaaaaaaaaaaaa!

This is so dumb and frustrating!!!!

my 2 second job (* 6 files) has become a two minute job!!!

Seriously! Slow SMB mounted drive + dumb image preview.....

PLEASE TELL ME THERE IS A WAY ROUND THIS DUMB FEATURE!!!!


You know how to plug security holes? LIVE IN A CAVE!!!!!!!

Unknown said...

I hate this feature too, and I wish they would at least give us the option to enter a file path manually.

AttilaNab said...

Hello. i was also having the same issue but Long Path Tool helped me in this situation. You can see here PathTooDeep.com. It might help you.
Thanks and Regards,
Attila