Include local path when user is uploading files to a server
This setting determines whether the local path of a file is sent to the server when a user uploads that file through an HTML form from a site in the Restricted Sites zone.
since 0.9.8.11
Purpose
Show registry keys (2)
HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\160AHKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\160A
This setting determines whether the local path of a file is sent to the server when a user uploads that file through an HTML form from a site in the Restricted Sites zone.
When the setting is enabled, the upload includes the path information. When it is disabled, Windows removes the local path from the submitted file information. If the policy is not configured, the user can control the corresponding Internet Explorer security setting; path information is sent by default.
The 160A value represents the URLACTION_HTML_INCLUDE_FILE_PATH URL security action and uses the REG_DWORD type. Policy value 0 (URLPOLICY_ALLOW) permits the path to be included, whereas value 3 (URLPOLICY_DISALLOW) prevents its inclusion.
Notes
Security
A complete local path can disclose information about the computer or user account to the receiving server. For example, a path to a file on the desktop can contain the user profile name. Directory names may also reveal details about internal storage structures or projects.
This setting does not give the server access to local directories or additional files. It controls only whether the path string for the file selected by the user accompanies the upload. It does not permit or block the file upload itself.
Notes
The Zones\4 key applies only to the Restricted Sites zone. This is an Internet Explorer URL-zone policy and affects only applications or components that evaluate these security zones and the associated URL action.
The two registry locations represent the computer and user variants of the same ADMX-backed policy.
Microsoft documentation
Microsoft Learn: URL Action Flags
Microsoft Learn: About URL Security Zones