Het Bijstere Spoor

We have had a whole bunch of issues with the Flash 8 uploader on OS/X in the past. Now its completely broken on leopard, but before we weren't able to do multi-file uploads because the 'onComplete' event wasn't triggered from within flash.

We've been using a (modified) version of SWFUpload and also our Flash applications have had this issue..

Today I read on The Joy of Flex-blog that there's actually a really simple solution to this problem. Have your PHP (or other server-side) simply return some data. Our upload-endpoint normally always returned nothing at all, because it seemed unnecessary, but returning a small body in your HTTP response fixes the issue!

As you can tell, I'm excited.

I don't want to sound like I'm complaining too much, because I actually really like the new version of os/x. I wanted to cover a bunch of problems so people might know its not just them.

First, my personal favourite improvements.

The terminal

I'm especially happy that some time was spent improving the terminal application. Half my day I spend in that application, and any small improvement is welcome there. The most important being tabs (yessss) and an always running ssh-agent (which integrates with the keychain).

I ran across a bunch of problems as well ..

Flash upload stops working

Since we deal at FileMobile a lot with uploads of large/huge files.. we use a Flash uploader. It completely stopped working in leopard and from what I hear an update of the flashplayer is in the works.

Windows magically disappear using spaces

Spaces is a nice tool and i feel like it could help productivity.. but when you're switching between a few spaces sometimes windows get completely lost and the applications need a restart to re-appear.

Terminal won't change the background color

I'm fairly sure this has to do with the fact that I used a background image for my terminal in tiger; which is a feature that has been removed in leopard. I really dislike the default black-on-white, but I couldn't change my background color anymore. The solution for this was to simply remove:

Library/Preferences/com.apple.Terminal.plist

From my home directory.

My key-bindings for page-up and page-down are lost in the Terminal.

I haven't felt like trying this yet, but I assume I simply have to follow my previous steps, if not.. I'll post about it later..

Airport up and down

Not sure if this is the OS or the airport, but its been shaky.. Hope this gets improved with an update of some sort.

I heard a few times in the past about SWFUpload and recently I decided to try it out..

Basically SWFUpload is a 0x0 pixel swf that allows you to leverage Flash 8's upload mechanism through html/javascript. Not only can you let your users select multiple files to upload, it also allows you to catch the progress nicely, without a combination of nasty hacks with javascript, hidden frames and server-side callbacks.. It it distributed under the very permissive MIT license.

However, the integration went pretty bad.. SWFUpload is a very complete package and includes a big javascript wrapper, a bunch of examples and SWFObject, which is used to embed the object in the html using javascript and examples. For some reason it didn't work for me all, I assume there was probably some collision with my existing javascript.. and I don't really like SWFObject, as it has to my opinion overkill written all over it..

So, I peaked into the javascript, only to find out that just using the swf you have a lot of power already, you can specify your javascript callback functions straight from though the flashvars.. Neat! The flashvars look something like this:

<param name="FlashVars" value="uploadBackend=%2Fservices%2Fupload&amp;uploadStartCallback=Uploader.onStart&amp;uploadProgressCallback=Uploader.onProgress&amp;uploadCompleteCallback=Uploader.onComplete&amp;uploadCancelCallback=Uploader.onCancel&amp;uploadErrorCallback=Uploader.onError&amp;allowedFiletypes=%2A.gif%3B%2A.jpg%3B%2A.mp3&amp;allowedFilesize=204800&amp;uploadQueueCompleteCallback=Uploader.onQueueComplete" />

Very easy to use.. The only thing I really miss is the fact that selecting files and uploading is a combined step.. Not really handy in terms of usability..

My feature requests:

1. Have a separate method for selecting files before upload.
2. Allow the ability to replace the file upload list, but also append to the list.
3. Have the callbacks return index numbers for the files.. Right now the only unique property you get is the filename, and there could be situations where 2 files with the same name are uploaded (rare, but still..).
4. Implement a method for canceling the upload progress.
5. Implement a method to remove a file from the upload queue.

The other problem I ran into using flash uploads are http cookie bugs.. I covered that in my last post.

This has been an issue that has been driving me pretty crazy.. I can't seem to find out how to share a (cookie-)session between flash and php.

The problem is that in certain situations Flash ignores session cookies when sending requests. The situations I know of are Flash Uploads and using Flash Remoting in internet explorer.

I asked my question on #webappsec and on the web application security mailing list, but there wasn't really somebody who could answer my quesion..

Options

1. I can pass the session id using flashvars directly. Problem with this is, is that the session id is directly embedded into the html and can therefore be stolen using CSRF.
2. I can use a temporary token, but anybody who has this token can do everything the user can in the flash application. For just the uploads it can work, but for everything else its not really flexible, and doesn't really fix the problem.
3. I could turn off httponly cookies and pass the session id using javascript straight to the flash movie.. This could be me only option, but I dislike it because its not as transparent as it should be and requires additional logic using javascript and flash (and php).
4. Force the user to login when using flash.. Not really a nice solution from a usuability perspective..

I'm wondering how other people go about this.. Is there a satisfying solution at all? Or can it only be done using a combination of nasty hacks?