I'm playing with a new service's very simple API and I'm just curious if its possible to send an xml-rpc request directly from an html form. The api request example is this:
<?xml version="1.0"?>
<methodCall>
<methodName>send</methodName>
<params>
<param><value><string>YOUR_API_KEY</string></value></param>
<param><value><string>msg@mycompany.com</string></value></param>
<param><value><string>5551231234</string></value></param>
<param><value><string>Test Message from PENNY SMS</string></value></param>
</params>
</methodCall>
And my current form iteration is this:
<form method="POST" enctype="text/xml" action="http://api.pennysms.com/xmlrpc">
<input type="hidden" name="api_key" value="MYAPIKEY"/>
<label for="from">From</label>
<input type="input" name="from" value=""/>
<label for="phone">Phone</label>
<input type="input" name="phone" value=""/>
<label for="text">Text message</label>
<input type="input" name="text" value="">
<input type="submit" value="Send"/>
</form>
-
Not without involving either Javascript or server code. The "enc-type" attribute specifies the format that the form data is sent to the server in, and unfortunately "xml-rpc" isn't in the list of accepted formats :)
Geuis : So I'm also guessing that since this would be cross-domain, using XHR isn't gonna work. Back to server side!Patrick McElhaney : You mean the "enctype" attribute, right?Ryan Brunner : @Patrick: Whoops, you're right. -
No, this is not possible from plain HTML. The only standard encodings for submitting form data are
application/x-www-form-urlencodedandmultipart/form-data.You can do this from JavaScript using an XMLHTTPRequest, though only to APIs on the same domain that the HTML came from. After a quick Google search, I found this AJAX XML-RPC client, though I've never used it so I can't vouch for it.
-
That might depend if the server is actually enforcing the enctype
For example using the technique shown here http://pentestmonkey.net/blog/csrf-xml-post-request you can do cross-site posts of XML POST data.
0 comments:
Post a Comment