SWFUpload

I've created a Cookie Bug demo which you can see at http://demo.swfupload.org/cookiebugdemo/. Please follow the instructions before saying that it doesn't do anything.

Remember that this is not a bug in SWFUpload but in the Flash Player.

This might be considered a proof of concept for a Flash security issue or as a tricky way to communicate between IE and another browser using Flash.

1) Any cookies from a non-IE browser (ie, authentication, login, etc) will not be sent with the file upload. Rather the cookies from IE will be sent. So, no cookies or the wrong cookies will be sent. In most cases this means sessions and cookie based authentication are lost when making an upload.

2) Cookies set by the upload script do get set, but only for Flash. The browser will not see them.

3) This bug affects Flash 8 and Flash 9 and all versions of SWFUpload

4) You cannot rely on cookies when using SWFUpload (or any Flash based upload tool). You must send the data you need from the cookies in another way. There are several threads regarding this issue in the forum and many of the demos show workarounds for restoring PHP sessions and some sample files show how to restore the cookies so Session and Authentication are restored in ASP.Net.

5) This could be considered a security issue but probably not severe enough to actually compromise any data. The cookies created in IE by Flash still have all the rules and restricts associated with cookies in any browser.

At last I found a solution that enables the use of SWFUpload with Drupal (and have Mac users be able to make it to the party), while leaving the core code intact.

Check it out (if you need more details I will provide):

http://blog.ascaniocolonna.com/?p=23

I'm having issues that I believe relate to this (error 403 within swfuploader).

I'm developing a module that uses SWFUploader and a drupal menu callback as the upload_url within this function I then do all of my functionality to upload the files to Amazon S3. I keep getting this:
SWF DEBUG: Event: fileDialogStart : Browsing files. Multi Select. Allowed file types: *.*
SWF DEBUG: Select Handler: Received the files selected from the dialog. Processing the file list...
SWF DEBUG: Event: fileQueued : File ID: SWFUpload_0_0
SWF DEBUG: Event: fileDialogComplete : Finished processing selected files. Files selected: 1. Files Queued: 1
SWF DEBUG: StartUpload: First file in queue
SWF DEBUG: Event: uploadStart : File ID: SWFUpload_0_0
SWF DEBUG: Global Post Item: PHPSESSID=gof8oipur7qo3n2drutg2pco22
SWF DEBUG: ReturnUploadStart(): File accepted by startUpload event and readied for upload. Starting upload to /photoshoot_project/upload/handler/1 for File ID: SWFUpload_0_0
SWF DEBUG: Event: uploadProgress (OPEN): File ID: SWFUpload_0_0
SWF DEBUG: Event: uploadProgress: File ID: SWFUpload_0_0. Bytes: 13732. Total: 13732
SWF DEBUG: Event: uploadError: HTTP ERROR : File ID: SWFUpload_0_0. HTTP Status: 403.
SWF DEBUG: Event: uploadComplete : Upload cycle complete.
Error Code: HTTP Error, File name: image.jpg, Message: 403

I think your fix will do the trick, but how do I set and send the session name?

Is this what is needed to restore it?
if(!isset($_COOKIE[$_POST['PHPSESSNAME']])) {
$_COOKIE[$_POST['PHPSESSNAME']] = $_POST['PHPSESSID'];
}
if (isset($_POST["PHPSESSID"])) {
session_id($_POST["PHPSESSID"]);
}
session_start();


Or is there something simple that I'm missing?