3

My custom module make ajax request on _node_edit form after input changed by user, and menu callback save this field's data (only this field, not all node object). Menu item is as "field-save/NID/FIELD_NAME", and the input val is on $_POST['field_data']. Menu item have own permission per role. Additionally each user have own randomly generated secure string and it is on the same ajax $_POST['secure_phrase']. Menu callback checking for permission per role and this secure string per user, if have access going forward to save field data.

The question: Is this enough security to prevent for unauthorised access to save field through this ajax request?

edit: additional for this on "access_callback" i have

if(!empty($_SERVER['HTTP_X_REQUESTED_WITH']) && strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) == 'xmlhttprequest') {
  // checking permissions here
}
Improve this question

1 Answer 1

Reset to default
1

It seems pretty secure. Also check the content type permissions for the role ;)

Improve this answer
3
  • Good suggestion, I will, tnx @rteijeiro
    – svetlio
    Commented May 8, 2013 at 14:58
  • Can you expand a little on why you this is secure?
    – mpdonadio ♦
    Commented May 8, 2013 at 16:51
  • The ajax callback is triggered with the menu item: field-save/NID/FIELD_NAME that is secured with Drupal permissions. Only a privileged user could update the field. You should also could send the field value to the javascript through Drupal settings instead $_POST. And also add some validation in the javascript.
    – rteijeiro
    Commented May 14, 2013 at 15:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.