jQuery Grid Plugin - jqGridForum

Topic RSS

Security with URL used in jqgrid

15/09/2010
16:23

thlas77

Member

Members

Forum Posts: 7

Member Since:
10/09/2010

Offline

Hi all,

I have a question about security in JQGRID.

When I display my grid, the URL generated can be copy/paste in Firebug. for example :

http://www.totosico.com/compon.....8;sord=asc

If I change filter_var1_id = 105 instead of 102, I can retrieve some data I'm not allowed to see (displayed in an XML format, not in the grid...)

So my questions are :

- How to prevent this ?

- Is it the right way to concat the variables in the URL ?

Thanks for your Help

Thierry

15/09/2010
17:25

OlegK

Germany

Member

Members

Forum Posts: 1255

Member Since:
10/08/2009

Offline

You should use server side user authentication and verify on every request whether it is allowed for him to retrieve the data or not. If you want that url with filter_var1_id=105 will be prohibited for all users you can also do this very simple on the server side.

If you only want to disallow to use filter_var1_id=105 in the url you can use in jqGrid and on the server HTTP POST instead of GET. In the case to get the data user need a tool like Fiddler (see http://www.fiddler2.com/fiddler2/) to get the data. Nevertheless such change will give you not really much more security.

So my answer: this should be a functionality of the server side of your code. So it is not a question to jqGrid. All client side validation in the case are unsafe.

Best regards
Oleg

15/09/2010
20:37

thlas77

Member

Members

Forum Posts: 7

Member Since:
10/09/2010

Offline

Thanks Olegk for your answer.

Just for your information, I want to use JQgrid with joomla.

In fact, I should verify that the user id is authorised to consult the data of the groupe with id 105. If not, an error message will be displayed.

I have a datasource.php where the query is coded to access to the database to retrieve the data for my grid.

Is it in this file that I have to code the request that userid and groupeid are compatible just before my query for the data?

To get the user id, I usually use in joomla $user =& JFactory::getUser(); and $current_user = (int) $user->get('id'); How can I do here ? (sorry if my questions are basics...)

If a joomla expert could help me, It will be nice(I have already downloaded component and module from http://www.dunia-azka.co.cc/)

Thanks

Thierry

All RSS

Forum Timezone: Europe/Sofia

Most Users Ever Online: 715

Currently Online:
79 Guest(s)