From 407798bba525671af49654a34961b66c58c85f58 Mon Sep 17 00:00:00 2001
From: Karl Lum <klum@labkey.com>
Date: Fri, 20 Jun 2025 17:47:34 -0700
Subject: [PATCH] POST a multipart form only when the page may upload a file
 (#896)

---
 .../flow/controllers/executescript/importAnalysis.jsp       | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/flow/src/org/labkey/flow/controllers/executescript/importAnalysis.jsp b/flow/src/org/labkey/flow/controllers/executescript/importAnalysis.jsp
index 956f5c52f9..3a4a171e65 100644
--- a/flow/src/org/labkey/flow/controllers/executescript/importAnalysis.jsp
+++ b/flow/src/org/labkey/flow/controllers/executescript/importAnalysis.jsp
@@ -44,6 +44,10 @@
     ImportAnalysisForm form = (ImportAnalysisForm)getModelBean();
     Container container = getContainer();
     ActionURL cancelUrl = urlProvider(ProjectUrls.class).getStartURL(container);
+    // we are only posting files for the first step of the wizard
+    String enctype = form.getStep() > AnalysisScriptController.ImportAnalysisStep.SELECT_ANALYSIS.getNumber()
+            ? "application/x-www-form-urlencoded"
+            : "multipart/form-data";
 %>
 <script type="text/javascript" nonce="<%=getScriptNonce()%>">
     function endsWith(a,b)
@@ -85,7 +89,7 @@
 
 <labkey:errors/>
 
-<labkey:form name="<%=ImportAnalysisForm.NAME%>" action="<%=new ActionURL(AnalysisScriptController.ImportAnalysisAction.class, container)%>" method="POST" enctype="multipart/form-data">
+<labkey:form name="<%=ImportAnalysisForm.NAME%>" action="<%=new ActionURL(AnalysisScriptController.ImportAnalysisAction.class, container)%>" method="POST" enctype="<%=enctype%>">
     <input type="hidden" name="step" value="<%=form.getStep()%>">
     <%
         for (Map.Entry<String, String> entry : form.getWorkspace().getHiddenFields(getViewContext()).entrySet())