My custom module make ajax request on _node_edit form after input changed by user, and menu callback save this field's data (only this field, not all node object). Menu item is as "field-save/NID/FIELD_NAME", and the input val is on $_POST['field_data']. Menu item have own permission per role. Additionally each user have own randomly generated secure string and it is on the same ajax $_POST['secure_phrase']. Menu callback checking for permission per role and this secure string per user, if have access going forward to save field data.

The question: Is this enough security to prevent for unauthorised access to save field through this ajax request?

edit: additional for this on "access_callback" i have

if(!empty($_SERVER['HTTP_X_REQUESTED_WITH']) && strtolower($_SERVER['HTTP_X_REQUESTED_WITH']) == 'xmlhttprequest') {
  // checking permissions here

It seems pretty secure. Also check the content type permissions for the role ;)

| improve this answer | |
  • Good suggestion, I will, tnx @rteijeiro – svetlio May 8 '13 at 14:58
  • Can you expand a little on why you this is secure? – mpdonadio May 8 '13 at 16:51
  • The ajax callback is triggered with the menu item: field-save/NID/FIELD_NAME that is secured with Drupal permissions. Only a privileged user could update the field. You should also could send the field value to the javascript through Drupal settings instead $_POST. And also add some validation in the javascript. – rteijeiro May 14 '13 at 15:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.