[whatwg] Re: overriding MIME type in accept attribute?

[Malcolm Rowe]

Hallvord Reiar Michaelsen Steen writes:
> This part of the WF2 spec about the file upload: "accept" attribute 
> seems a bit odd to me: 
> 
>> UAs may allow the user to override the MIME type to be one of the 
>> allowable types if the file is originally incorrectly labeled (but 
>> should not allow users to override the type merely to let 
>> submission continue, as that would defeat the point of having a 
>> restriction in the first place)
>
> How is the UA to allow the user to override a MIME type and how on 
> earth is it supposed to know the user's motivation for doing so?

Up to the UA. For example, if a file upload control had accept="image/*", a 
Windows-based UA could present a standard 'file open' dialog containing a 
list of all files matching that type (which, on a Windows machine, would 
probably be those files with file extensions that mapped to a matching MIME 
type). 

What the UA should not then do, IMO, is allow the user merely to change the 
file type in the dialog from 'Image Files' (or whatever) to 'All Files', and 
upload a differently-typed document. One possibility would be to present a 
warning dialog first, something like: 

"The file that you are trying to upload is a [Microsoft Word 8.0 Document], 
but the server has requested only [image] files. If you believe that this 
file really is an [image] file, you can override this warning. 

[Upload anyway] [Cancel]" 

(or something suitably mpt-filtered, anyway). 

> Another issue: on Windows, if I try to upload a file with no 
> extension, how is the UA supposed to work out what the MIME type is? 
> Content sniffing?

Up to the UA, and the correct answer is probably 'it can't'. This mechanism 
isn't supposed to prevent users uploading files that the server isn't 
interested in, it's supposed to make it easier for the server to identify 
what's valid, so that the user experience is improved. 

Or, to phrase the same problem another way: "If I try to open a local file 
with no extension [via a file:// URL], how is the UA supposed to work out 
what the MIME type is?". 

Regards,
Malcolm