parsley remote validation - include more data in request - validation

I have started using parsley.js for for validation and it is working great, just added more advanced validation that needs remote data, and got an issue. parsley-remote works fine, but it only send the data of that specific field to the server (title). In order to do my validation, I need also the data stored in the hidden field name="mcid". Can I manage this with parsley? Ideally a general approach that I can use for my entire application (large application, so keeping page specific code to a minimum).
My form (simplified):
<form>
<input type="text" name="title" required="required" parsley-validation-remote="/Admin-Category/validateMainCategoryTitle/" data-validation-remote-method="POST"/>
<input type="hidden" name="mcid" value="2060"/>
</form>

I don't believe that there is an easy way to do it with the built-in Parsley remote validator - any possible solution would be a complicated workaround and you would be better off going with straight JavaScript to do it.
How is the value in the hidden field set? If I were doing this in Java, I would put the hidden field in the DTO or in the UpdateController so the value would be available to the validateMainCategoryTitle method. Is that possible with your application?
Alternatively, since you have both the values available on the form, can you write a custom parsley validation routine to check them, or do you need to go back to the server for some reason?

Just a follow up on my own question. Parsley is now release in v.2 and the new parsley remote plugin has standard support for sending more parameter. Problem solved!

Related

Laravel-8 Livewire-2 was hacked when passing data through wire:click

When I passing data in the blade file through wire:click="data('text')" then it's working fine.
But if I change the value in the blade file like wire:click="data('new text')", then this value changed.
This is my blade file
<button wire:click="delete('1')" type="button">Delete Record</button>
But when I change the value in the blade file and click on the button then this value changed.
<button wire:click="delete('10')" type="button">Delete Record</button>
Please! tell me. How this problem will be solved.
The short answer is, that's how any and all forms work - be it Livewire, a standard HTTP form or via Ajax. This can be done with any data the user passes to your server, and it's normal, expected behaviour. There is no way you can prevent it entirely. Users can manipulate any of the data they send themselves.
The lesson here is don't trust user input! And to act on that, you need authorisation and validation of all incoming requests. This must be done on the server where you accept the request (meaning in PHP) and not in the client (like JavaScript), as anything client-side can be manipulated by the user like you've just seen.
Laravel offers policies and guards, so that you very easily can validate that the user has access to perform given actions and change or delete the record they attempt to act on. This makes validation and authorisation very easy in Laravel projects, but there's no magic - you have to implement it for all of the requests where users can pass data or call actions in your application.

Updating joomla admin component from 2.5 to 3.x

I'm trying to update our templates and current modules and backend admin components to work with Joomla 3.
I've updated the component file to use JControllerLegacy etc where needed, and I can see it in my backend - basically. It's a field you put a string of information in, and that gets saved to the database and then gets re-used in other modules.
I can input stuff into the text field, but if I go to click save, save and close, or cancel absolutely nothing happens.
I haven't missed any files out as this was a direct import from a working version on 2.5.x and when I run web console it tells me:
TypeError: b is null # /media/system/js/core.js:4
and
Empty string passed to getElementById(). # /media/jui/js/jquery.min.js:2
Which I assumed was that it was trying to tell me the text field was empty. However, no matter what's in there, it still doesn't do anything, and I would have thought the cancel wouldn't matter if there was anything in the box or not.
Any pointers would be great.
Do you have the hidden inputfield <input type="hidden" name="task" value="" /> in your form?
When clicking a button, the Javascript function Joomla.submitbutton(task) is called. This should be defined/overriden in your layout to make some checks and then call Joomla.submitform(task), which fills the task into the hidden field and sends the form.
I think these functions have changed their name someday. Maybe you still got them without the Joomla prefix?
Take a look at this page - http://docs.joomla.org/Potential_backward_compatibility_issues_in_Joomla_3.0_and_Joomla_Platform_12.1
Some things have changed between 2.5 and 3.0, mostly dealing with dropping 1.5 style code. Also, take a look at the core components and use them as references to verify what you're doing is right.
the JToolBarHelper:save(); was replaced with JToolBarHelper::save2new(); in further Joomla3 Versions

ajaxified file upload in jsf

I want to do a file upload without posting an entire form. The file upload works fine, but the whole form is submitted. This works fine when validation is correct. But when p.e. a required field is empty, the upload does not work and a error message is returned (required field missing)
So i tried to ajax the file upload (ajax=true). But then the upload does nothing.
I tried a work around bu putting the file upload and other fields in different forms. This works, but the result is that data you changed in the other fields is disregarded when doing the file upload.
Any suggestions?
Here is my code I use:
<t:inputFileUpload id="fileupload" value="#{prospectDetail.upFile}" size="50" />
<h:outputLabel for="description" value="#{msg.prospectdetail_description}"/>
<mw:inputText id="description" size="40" value="#{prospectDetail.fileDescription}" />
<p:commandButton styleClass="button" value="#{msg.common_upload}" action="#{prospectDetail.upload}" ajax="false" process="#form" onbegin="busyPopup.show()" oncomplete="busyPopup.hide();"/>
It is not possible to upload files by first version of XMLHttpRequest (which is the core Ajax request controller object in JavaScript). The second version of XMLHttpRequest supports it, but this is not implemented by <p:commandButton> (and has currently low browser support).
As you seem to be using PrimeFaces already, why don't you just use its own <p:fileUpload> component? The single upload or even the auto upload examples should do it for you (don't forget to remove the MyFaces extensions filter from the web.xml after adding the PrimeFaces' file upload filter!). The PrimeFaces' <p:fileUpload> will automatically utilize XHR2 file upload whenever available.
I tried a work around bu putting the file upload and other fields in different forms. This works, but the result is that data you changed in the other fields is disregarded when doing the file upload.
If you put the bean in the view scope instead of the request scope and return null or void from action methods, then this should work.

Unobtrusive Javascript Validation with MVC 3, is preventing me validating form manually

For 90% of my site the standard MVC annotation with client script method is working a treat. But I have a form on the site that is quite complicated with multiple instances of dynamic form content dependant on answers to questions etc.
If I have the unobtrusive script included on the page, it's capturing the form submit and not allowing my custom jquery validate to validate the form.
I don't really want to refactor the site to have a seperate layout to remove the script when it's not needed. I wondered if there was an easy way to give control back to my custom validate script.
Any help would be great.
In your view you can disable client side validation like this
Html.ViewContext.ClientValidationEnabled = false

Is JSF validation client-side or server-side?

I implemented my validation logic as follows:
<h:inputText id="title" value="#{...}"
required="true" requiredMessage="...some..text..."
validatorMessage="...some..other..text..." >
<f:validateLength minimum="10" maximum="50"/>
</h:inputText>
I read a lot about clientside and serverside validation and about their advantages and disadvantages. But I have no idea about what the code above does.
Can somebody please explain that :-)
Cheers
In client side validation, it's the client (webbrowser) which validates the input with help of a client side language, e.g. JavaScript. In server side validation, it's the server (webserver) which validates the input with help of a server side language, e.g. Java.
You should never do only client side validation, because the result is controllable (and thus also hackable/spoofable) by the enduser. Usually, you'd like to use client side validation because it gives much sooner feedback. The enduser doesn't need to wait for the form submit being completed and doesn't need to face a "flash of content" (page blanks out and then redisplays with new content). You'd like to use server side validation to ensure the integrity of the submitted data. The enduser has in no way control over the outcome of the server side validation.
In case of JSF, the validation via built-in required="true" attribute and standard/custom validators is always server side. Since JSF 2.0 it's possible to submit a form (and thus also validate the form) using builtin ajaxical functionality. This combines the best of the two worlds: having instant feedback without flash of content and the robustness/integrity of the server side validation.
See also:
How to perform validation in JSF, how to create a custom validator in JSF

Resources