Re: Disabling a form element server-side
Re: Disabling a form element server-side
- Subject: Re: Disabling a form element server-side
- From: John Baldwin <email@hidden>
- Date: Thu, 12 Jun 2008 17:06:54 -0700
I'm assuming you know that the user doesn't have access to update the
info since you know when to disable the items.
You could bind to non-EO variables and only update the EO with the
ones the user has access to.
Never trust the browser for security (as you discovered). Disabling
the elements is good feedback for the user, though.
Sent from my iPhone
On Jun 12, 2008, at 4:13 PM, Dan Grec <email@hidden> wrote:
All,
We're currently using the "disabled" binding (and thus HTML) to stop
text entry into fields when a user doesn't have access.
(i.e. WOTextField, WOCheckbox, etc)
This presents a problem, as users can use an inline proxy or firebug
to submit the data anyway, which gets saved.
Our customers are complaining this is a security risk, so we have to
do something.
We're trying to come up with a way to handle the disabling on the
server side, rather than letter the browser deal with it.
We thought about conditionally rending them as a text equivelant (ie
WOString instead of WOTextField) but this will be pretty annoying
for WOCheckbox & WORadioButton.
Does anyone have any suggestions?
Thanks,
-Dan
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Webobjects-dev mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Webobjects-dev mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden