POST multipart/data file upload Question

[kseminuk]

I'm attempting to create a VI that automates the process of a user uploading a file through a PHP website.  The website requires the user to Login with certain credentials on a Login Page prior to navigation to a Upload webpage.  When the user gets to the Upload webpage, here is the php code for POST

<form action="upload2.php" method="POST" enctype= "multipart/form-data">

<label for="file">Filename: </label>

<input type="file" name="filetobeuploaded" id="file"><br>

</br></br>

<input type="submit" name="submit" value="Submit">

</form>

I've written a VI (attached) that uses the POST multipart/data action to upload the file to the webpage.  The issue that I'm encountering is that the webpage that I'm running needs to store a "session" to store cookies, etc. so that the login information can be saved, and passed on when I navigate from the Login Page to the Upload webpage.  When I attempt to upload the file, I get the error:

‘This Page Cannot be displayed’;

“<br /n>”;

‘Access denied for current user login’;

‘<script type=”text/javascript”>alert(”Access denied: This page cannot be displayed.\r\Click OK to go back”);history.back();</scripts>’;

I haven't tried using the Web Services implementation because I'm merely emulating the client action of uploading the file.  I'm currently using the GET method to obtain Header information and parsing that info for a PHPSessionID which I then write to a text file.  I then pass that text file into this VI as the cookie info.  Unfortunately, I haven't had much success.

Can anyone recommend a workaround?

[Rscd27]

As i see it the issue seems to be in that you are not being able to login the webpage. I am not really famililared with web services but i have out a document to have a Login option i a web service:

http://digital.ni.com/public.nsf/allkb/DF41D5DA8EEB4840862577D90058C208

And this is a tutorial for web services on LabVIEW and Real Time

[rolfk]

You should try to do the login on the LabVIEW HTTP session itself. Cookie information is stored in the HTTP session, so as long as you do both transactions in the same session it can work. Currently you do the login in your web browser and then the multipart upload in the LabVIEW HTTP session and they can not know anything about each other.

And if the PHP server only would rely on the generated SessionID for identification of the remote side it would be a pretty insecure service. Usually there are several elements involved for a secure login handshake to guarantee that a man in the middle attack is not successful.

Possibly your PHP server implements the login through Javascript code which the LabVIEW HTTP VIs don't execute. So you may have to change the PHP side to allow for an alternative login possibility in the form of a web service or something.

[kseminuk]

Thanks for the info Randy.  I'm not sure that the Web Services will be my best answer, but it's definitely worth investigating the possibility.

[kseminuk]

@Rolf - You're suggesting that I perform the login on the File Upload page rather than the Login Page?

I think I need to store the actual Session variables from the Login so that they can be passed to the File Upload Page.  See below for the php code on the Login page:

<?php

session_start();

include("passwords.php");

if ($_POST["ac"]=="log") { /// do after login form is submitted

//global $user3;

$user2 = strip_tags($_POST["username"]);

$user3 = ($_POST["username"]);

if ((strlen($user2)>2) && ($_POST["password"] == $pass1 || $_POST["password"] == $pass2 || $_POST["password"] == $pass3 || $_POST["password"] == $pass4)) { /// check if submitted

//username and password exist in $USERS array

$_SESSION["logged"]= $user3;

$_SESSION["password"]=$_POST["password"];

$_SESSION["loggedIn"] = true;

shell_exec('sudo / "'.$user3.'" 0 255');

} else {

if ($_POST["password"] != $pass1 || $_POST["password"] != $pass2 || $_POST["password"] != $pass3 || $_POST["password"] != $pass4)

{

shell_exec('sudo / "'.$user3.'" 0 0');

}

else

{

shell_exec('sudo / "'.$user3.'" 0 2');

}

echo 'Invalid User Credentials Submitted. Please, try again.';

echo "<br />\n";

};

};

if (($_SESSION["logged"] == $user3) && ($_SESSION["loggedIn"] == true)){ //// check if user is logged or not

if(($_SESSION["logged"] == $user3) && ($_SESSION["password"] == $pass1))

{header( 'Location: index1.php' );

$_SESSION['access'] = 1;}

else if($_SESSION["logged"] == $user3 && ($_SESSION["password"] == $pass2))

{header( 'Location: index1.php' );

$_SESSION['access'] = 2;}

else if($_SESSION["logged"] == $user3 && ($_SESSION["password"] == $pass3))

{header( 'Location: index1.php' );

$_SESSION['access'] = 3;}

else if($_SESSION["logged"] == $user3 && ($_SESSION["password"] == $pass4))

{header( 'Location: index1.php' );

$_SESSION['access'] = 4;}

} else { //// if not logged show login form

echo '<form action="login.php" method="post"><input type="hidden" name="ac" value="log"> ';

echo '<label for="UserName">Username </label>';

echo '<align="center"><input type="text" Placeholder="Username" name="username" autofocus/>';

echo "<br />\n";

echo "<br />\n";

echo '<label for="password">Password </label>';

echo '<align="center"><input type="password" Placeholder="Password" name="password"/>';

echo "<br />\n";

echo "<br />\n";

echo '<br><input type="submit" name="submit" value="Submit" />';

echo '</form>';

I'll see if your recommendation works - I can use the basic "POST" VI to pass user credentials on the Login Page then use the Header to collect Session info.  Thanks.