Mozilla would probably object to implementing this on security grounds.  Since pages can put the filepicker up from script, the proposal makes it trivial to use a user holding enter for a bit too long to put up the filepicker, select a file of the web page's choice, and send it to the server.

The use cases are good, but we need to solve the above problem before this can end up in the spec.

What could be implemented is:
When the window is opened a timer starts. If the window has been opened for less than 1s then (you must decide what to do):
- Reopen the file picker without saving the previous submitted value (must contain a max nº of times this repeats and know what to do if that counting went to 0)
- Don't accept the input. Use the previous value. (I think I'll go with this one)

What do you think of this solution?

> If the window has been opened for less than 1s

I doubt that's acceptable... it's too short.  3-5s is the standard I've seen used for delays like that.

And it would _still_ screw over users who select a file quickly.

(In reply to comment #3)
> > If the window has been opened for less than 1s
> 
> I doubt that's acceptable... it's too short.  3-5s is the standard I've seen
> used for delays like that.
> 
> And it would _still_ screw over users who select a file quickly.

I've made tests with people that are slow working with the file picker and with people that are fast with the file picker.
The slow ones, take about 1s to react that the file picker have appeared.
I asked 4 slow people to go to a webpage where I'd open the file picker when they less expected and see how would they react. The 1s is too little, 2s works ok, 3s still ok.
For experienced people, like me, the only reason to speed up the select of open is to check the file and give the ok. To accomplish that, I was the fastest in the tests I made (not many people actually) and I toke almost but not quite 3s to:
Confirm the filepicker was opened (about 0,4s).
Locate the file to pick (about 0,7s) (if it was to confirm what was selected, it would be about the same)
move the mouse to the file to dblclick.

Probably the 2s is the best one and better than 1s... What do you think?

I think this needs review by the security teams of the various browsers, mostly.

(In reply to comment #5)
> I think this needs review by the security teams of the various browsers,
> mostly.

is there a way where I can call them all to see this?

I agree with Boris, it's unlikely that we'd implement this in Firefox. It's simply too easy to trick the user into selecting a file that they don't intend to share. Here's one attack scenario:

1. Add a <input type=file value="/etc/passwd"> on a page
2. Use CSS to make the <input> 1x1 pixels large
3. Put a <a href="money.html">Click here for free money</a> link on the page
4. Use javascript to detect when the user hovers the above link
5. Use CSS to position the <input> just under the cursor.

Once the user attempts to click the link it will instead open a filepicker. Most people's reaction to this would be "get out of my way stupid dialog, I want to click my free-money link" and simply press "OK" in the file picker.

This is generally known as the "whatever button". When faced with a dialog people generally don't bother reading its contents but instead think "whatever" and press any button that will allow them to continue with their task.

(In reply to comment #7)
> I agree with Boris, it's unlikely that we'd implement this in Firefox. It's
> simply too easy to trick the user into selecting a file that they don't intend
> to share. Here's one attack scenario:
> 
> 1. Add a <input type=file value="/etc/passwd"> on a page
> 2. Use CSS to make the <input> 1x1 pixels large
> 3. Put a <a href="money.html">Click here for free money</a> link on the page
> 4. Use javascript to detect when the user hovers the above link
> 5. Use CSS to position the <input> just under the cursor.
> 
> Once the user attempts to click the link it will instead open a filepicker.
> Most people's reaction to this would be "get out of my way stupid dialog, I
> want to click my free-money link" and simply press "OK" in the file picker.
> 
> This is generally known as the "whatever button". When faced with a dialog
> people generally don't bother reading its contents but instead think "whatever"
> and press any button that will allow them to continue with their task.

I also go with whatever. But instead, I ALWAYS use the cancel button instead of the ok button. Still... I see what you mean...

I'll do a worksforme as this is not going to be easy enugh to implement.

mass-moved component to LC1