Donna after Olav wrote:

>> only 'txt' extensions are permitted through.

>ok....but is that safe?  just wondering....

Well, that might depend on your client tools. Just a few
days ago I was (again) surprised by the Micro$soft browser,
for example, to refuse to display a plain text file "as is"
but to render it as HTML instead.

A co-worker creating a small Java Servlet tutorial had a
couple of Java source files in his web pages, properly sent
to the browser as MIME-type text/plain (not sure if they
were named .txt or .java) but the MS browser refused to show
(only) one of them as plain text. Netscape worked nicely on
all those files...

It turned out that the Java source code had a comment within
the first few lines that had the seemingly "magic" word HTML
in it. Once we removed that line, MSIE began to display that
file as text/plain as well.

So it seemed that MS did not follow the MIME-type as expected.

After your posting, I began to wonder if embedded JavaScript
in that text/plain file would also have been executed by MSIE.

Lars.

(oh, my co-worked claimed to have the latest MS patches)

* To join/leave the list, search archives, change list settings, *
* etc., please visit http://raven.utc.edu/archives/hp3000-l.html *