javascript - jQuery security issue -


i'm feeling scared solution i'm using in 1 of app. basically, use snippet : 

var username = ...; $.ajax({ type: "post",     url: "getfeed.php",     data: "username="+username,     success: function(html) {     // stuff              } });

my question : hackable ? if use chrome/firefox/... build-in code editor , replace var username = ... var username = 'user1';, work ?

thanks

yes, javascript debugger able change variable whatever username want. javascript open user , can modified easily.

typically have login page authenticate user (often cookie based), , on every subsequent request (ajax or otherwise) able authenticate cookie , make sure user says is. require server side solution authentication.


Comments

Post a Comment

Popular posts from this blog

rdbms - what exactly the undo information lives in oracle? -

some docs says, there "undo tablespaces" implies should create tablespace undo imformation. some docs says, there "undo segment" implies undo information lives in normal tablespaces , use of it's segment. so, undo information lives , organized? earlier releases of oracle database used rollback segments store undo. oracle9i introduced automatic undo management, simplifies undo space management eliminating complexities associated rollback segment management. oracle recommends (oracle 9i , on words) use undo tablespace (automatic undo management) manage undo rather rollback segments. when creating undo tablespace, these automatically created: n undo segments (based on sessions parameter value) named _syssmun$ owned public (usable ops configuration) not manually manageable
Read more

bash - How do you programmatically add a bats test? -

i'd have bats test created every file in directory, i'm not sure best way done is. approach below creates single test when there many files in directory. #!/usr/bin/env bats in $(ls) @test "testing $i" { pwd } done to extract ls output not batter solution go wrong on filenames spaces. you can below shopt -s nullglob file in /dir/* //test command on $file done shopt -u nullglob you can using find command also find /some/directory -maxdepth 1 -type f -exec cmd option {} \;
Read more

java - Getting exception in JDBC thin driver -

i try run query using java , below mentioned program import java.sql.connection; import java.sql.drivermanager; import java.sql.resultset; import java.sql.statement; import javax.naming.spi.dirstatefactory.result; public class oracleconn { public static void main(string[] args) { try { class.forname("oracle.jdbc.driver.oracledriver"); connection con = drivermanager.getconnection("jdbc:oracle:thin:@localhost:1521:yglobal","user","user"); statement stmt = con.createstatement(); resultset rs = stmt.executequery("select empid empmaster"); while(rs.next()) system.out.println(rs.getint(1)); con.close(); } catch (exception e) { e.printstacktrace(); }} } but when tried run program getting exception java.sql.sqlexception: ora-01756: quoted string not terminated @ oracle.jdbc.driver.databasee...
Read more