0

I am a doctor who is seeking a solution for my patients. I often receive medical CDs from my patients which contain their radiological data. What I need is a web solution which I can integrate with my web site. But the caveat is that I dont want this to happen via Choose File. Most of my patients are old people who doesnt know much about internet or computers. So I want a single button on my web site which will copy the entire CD in the CD drive and send it to me without any user intervention. Is it possible?

Update:

OK thank you all. I did not intend to break copyright issues. Actually, I thought a user who will hit that "button" will also give permission to access their files. I completely understand your concerns and I completely agree however - as an end-user - this is the problem requiring a solution in my case. After the COVID none of my patients can come to clinical visits and I need to see their follow-up. In neurosurgery, this is very important. I do not know if it is OK to send links (and sorry if it is not) here but for example, this web site makes something similar to my idea but it is not free and it is so complicated for my -low socioeconomic - patient profile. My target population mostly deals with brain tumors and their level of concern for copyright issues is so low for that reason. I don't mean taking everything from them without their will but this is the case. So again thank you all for enlightening me and I am again sorry if I break the rules of this website.

tukan
  • 17,050
  • 1
  • 20
  • 48
AlpB
  • 25
  • 3
  • 1
    *"I want a single button on my web site which will copy the entire CD in the CD drive and send it to me without any user intervention. Is it possible?"* No. If it was, it would be an ***huge*** security risk to the web user / patient. – Andrew Thompson Jan 16 '21 at 21:54

2 Answers2

4

As Andrew mentioned this SO is used for Q&A from/to developers. I'll try to give you a general idea what could be done.

Who should do it?

I think you need some freelancer who would create a code for you. The mechanism you are describing is not possible due to security issues. Web page should not have access to the HW, as you would like, without user interaction.

What is then feasible?

I think what is feasible is an application (thick - meaning .exe file) which would be executed by your patients which would search for a CD/DVD drive, pack it and send it via secure channel to your server. They would need to download it and execute it.

If you have elderly patients you need to visually confirm that the data has been send using some clear message. Something like: Thank you for sending the data to Dr. Jones. All data has been received.

Secure channel can be for example: ftps, sftp, https, etc.

On your side you would a have a daemon which would serve as endpoint for your patient's data. After receiving the data it should be moved immediately outside the uploading folder.

Edit

One more option that came into my mind would be to distribute a tailored USB key to your patients with such application, which would be executed upon insertion.

tukan
  • 17,050
  • 1
  • 20
  • 48
  • Good choice on the information under ***"What is then feasible?"***, that deserves an up vote. That's some good thinking about possible alternatives. – Andrew Thompson Jan 19 '21 at 11:03
  • 1
    @AndrewThompson Thank you. I think it is hard to imagine the possibilities when your expertise is in different field. – tukan Jan 19 '21 at 11:13
4

Introduction

I'm going to go through the reasons as to why the specification as stated, cannot be implemented, and also as to why older technologies that may have allowed this implementation cannot be used.

Do note that even older technologies, would have required some sort of installation or agreement from the user- as a minimum 1 click.

Also note: It is possible to get files from a users system, but you still have to get their agreement through an action or prompt from their part!**

As to what you could do? Tukan already covers some nice alternatives but if I do think of something I will add it!

Basic Explanation

The most basic explanation is that this would be a giant unprecedented security hole. It would mean that browsers would allow a site to access files from a users computer hardware (DVD) without the permission of the user or the active actions of the user.

In your case you do have a valid non-malicious use for it. Imagine however all the malicious websites that would use this mechanism to steal stuff off the DVD/CD that is in the users tray. Imagine the privacy issues, security breaches, and even minor stuff like copyright issues.

Finally, and even worse, if the specific requested allowed access to the whole file system (including all drives like C:), a malicious site could steal everything on a user's system.

The positive (and negative for you) is that browsers have been incrementally locked down over the years and technologies/plugins/extensions/features have been incrementally either locked down, or deprecated/removed. Such technologies include: active X, java applets, and flash.

Finally, browsers like chrome and internet explorer themselves now'a'days run in sandboxes. See for example the article (and this is from 2013!!): Sandboxes Explained: How They’re Already Protecting You and How to Sandbox Any Program

They’re restricted to running in your browser and accessing a limited set of resources — they can’t view your webcam without permission or read your computer’s local files. If websites you visit weren’t sandboxed and isolated from the rest of your system, visiting a malicious website would be as bad as installing a virus.

Other programs on your computer are also sandboxed. For example, Google Chrome and Internet Explorer both run in a sandbox themselves. These browsers are programs running on your computer, but they don’t have access to your entire computer. They run in a low-permission mode. Even if the web page found a security vulnerability and managed to take control of the browser, it would then have to escape the browser’s sandbox to do real damage.

Active X (Deprecated) (Internet Explorer)

Let's start by saying that Active X would require the user to change their Internet Explorer Security Settings so we can strike it off immediately.

If a user did change their settings (see: Enable ActiveX controls in Internet Explorer ) and Enable for IE 11, a developer could use active x to access files on a users system.

Also note Active X is deprecated and rumour has it that it may not be around for long.

Java Signed Applets

Java Signed Applets could access the local file system.

However, Applets are no longer supported in firefox and chrome. They do run in Internet Explorer though IE is deprecated as well (since people are moving to Edge).

There's a very well written answer on the topic here: How do I run Java applets? [duplicate] and Why is the Java plugin (JRE) disabled in Chrome?

Adobe Flash (Previously Macromedia)

First off, flash has been removed from most Internet Browsers and is officially considered dead. Additionally, after Flash Player 10 it was possible to load a file but the user had to select it himself through a dialog (see: Can Flash action script read and write local file system? ).

FileSystem and FileWriter APIs

You can read and write using this API. However, it again requires the user to interact with the webpage and to select the files themselves.

References

Menelaos
  • 23,508
  • 18
  • 90
  • 155
  • 2
    *"and even minor stuff like copyright issues."* Huh.. I'd not thought of that! **BTW:** I'm no expert on security, but am the top ranked provider of answers re (Java) applets on SO. It pained me that Sun/Oracle would .. *repeatedly* find & fix security bugs, only to have the *exact same bug* appear in a later runtime environment (next Java plug-in version). I hated to see applet support removed from browsers (then Java itself), but would've done the exact same thing if I was a browser maker. The other answer is good, but this answer is better. Thanks for the comprehensive & referenced answer. – Andrew Thompson Jan 24 '21 at 20:47
  • 1
    @AndrewThompson I really like the answer too (upvoted) as it gives you an overview of the technologies, but most of them are dead. It is also important to understand that the original question is from non-technical person for him it is in gibberish. – tukan Jan 25 '21 at 10:15