jQuery Grid Plugin - jqGrid - Topic: Security with URL used in jqgrid http://www.trirand.com/blog/?page_id=393/help/security-with-url-used-in-jqgrid Simple:Press Version 5.7.5.3 thlas77 on Security with URL used in jqgrid http://www.trirand.com/blog/?page_id=393/help/security-with-url-used-in-jqgrid#p19797 Help http://www.trirand.com/blog/?page_id=393/help/security-with-url-used-in-jqgrid#p19797 Thanks Olegk for your answer.

Just for your information, I want to use JQgrid with joomla.

In fact, I should verify that the user id is authorised to consult the data of the groupe with id 105. If not, an error message will be displayed.

I have a datasource.php where the query is coded to access to the database to retrieve the data for my grid.

Is it in this file that I have to code the request that userid and groupeid are compatible just before my query for the data?

To get the user id, I usually use in joomla         $user    =& JFactory::getUser(); and $current_user = (int) $user->get('id'); How can I do here ? (sorry if my questions are basics...)

If a joomla expert could help me, It will be nice(I have already downloaded component and module from http://www.dunia-azka.co.cc/)

Thanks

Thierry

]]> Wed, 15 Sep 2010 20:37:40 +0300 OlegK on Security with URL used in jqgrid http://www.trirand.com/blog/?page_id=393/help/security-with-url-used-in-jqgrid#p19792 Help http://www.trirand.com/blog/?page_id=393/help/security-with-url-used-in-jqgrid#p19792 You should use server side user authentication and verify on every request whether it is allowed for him to retrieve the data or not. If you want that url with filter_var1_id=105 will be prohibited for all users you can also do this very simple on the server side.

If you only want to disallow to use filter_var1_id=105 in the url you can use in jqGrid and on the server HTTP POST instead of GET. In the case to get the data user need a tool like Fiddler (see http://www.fiddler2.com/fiddler2/) to get the data. Nevertheless such change will give you not really much more security.

So my answer: this should be a functionality of the server side of your code. So it is not a question to jqGrid. All client side validation in the case are unsafe.

Best regards
Oleg 

]]> Wed, 15 Sep 2010 17:25:47 +0300 thlas77 on Security with URL used in jqgrid http://www.trirand.com/blog/?page_id=393/help/security-with-url-used-in-jqgrid#p19791 Help http://www.trirand.com/blog/?page_id=393/help/security-with-url-used-in-jqgrid#p19791 Hi all,

I have a question about security in JQGRID.

When I display my grid, the URL generated can be copy/paste in Firebug. for example :

http://www.totosico.com/compon.....8;sord=asc

If I change filter_var1_id = 105 instead of 102, I can retrieve some data I'm not allowed to see (displayed in an XML format, not in the grid...)

So my questions are :

- How to prevent this ?

- Is it the right way to concat the variables in the URL ?

Thanks for your Help

Thierry

]]> Wed, 15 Sep 2010 16:23:40 +0300