Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Include local path when user is uploading files to a server

This setting controls whether the local path of a selected file is sent to the server when the user uploads the file through an HTML form.

since 0.9.8.11

Purpose

Show registry keys (2)
  • HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\160A
  • HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\160A

This setting controls whether the local path of a selected file is sent to the server when the user uploads the file through an HTML form. It represents the Internet Explorer URL action URLACTION_HTML_INCLUDE_FILE_PATH for the Internet zone (Zone 3).

The registry value uses the REG_DWORD type. A value of 0 (URLPOLICY_ALLOW) includes the path information in the submission. A value of 3 (URLPOLICY_DISALLOW) removes the local path information. Removing the path does not, by itself, prevent the selected file from being uploaded.

When the policy is not configured, the user can choose whether path information is sent. Microsoft documents the default behavior as sending the path information.

Notes

Security

A full local path can disclose information about the client system to the receiving server. For example, the path of a file stored on the desktop can contain the user's profile name. Directory names and the structure of a local or mapped storage location may also become visible.

Removing the path reduces this unintended disclosure. The setting does not change the user's file-system permissions or give the server access to additional local files.

Possible side effects

When path information is removed, server-side applications no longer receive the file's complete client-side location. Legacy applications that inspect or expect that path may therefore behave differently. The setting does not block the file contents or the upload operation itself.

Notes

This setting applies only to the Internet zone and to file uploads through HTML forms in components that use the Internet Explorer security-zone model. The corresponding values under HKLM and HKCU represent computer and user policy respectively.

The value name 160A identifies URLACTION_HTML_INCLUDE_FILE_PATH, which Microsoft introduced with Internet Explorer 7.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP

Microsoft Learn: URL Action Flags

Microsoft Learn: URL Policy Flags

See also