Level 35
Can you show your blade file?
Nov 6, 2022
10
Level 1
JavaScript and PHP
I need an advice. When a user's page is loaded, some data is loaded separately via ajax so as not to slow down the page loading. The user can edit and delete some data, there are corresponding buttons for this. How can I hide these buttons from third parties who will view profile? In other places, I just check the user id and the viewer id, but in this place the content is created in javascript and there I cannot use php code.
Level 1
@Ben Taylor The template has a div with the desired id, there is nothing else
Level 75
Level 1
@jlrdw This won't help, I need to use validation specifically in the javascript file, because the content is loaded there
Level 75
@deekepMaks no the data is loaded in the back end and passed via a Json response so validations still needs to take place on the backend.
If you implement some front end validation just to make sure something is filled out that's fine but you still need to validate on the back end.
Edit:
You can also hide and show buttons using JavaScript depending on a condition.
Also:
but in this place the content is created in javascript and there I cannot use php code.
Does that mean you have data that doesn't come from the database?
Level 1
@jlrdw I am getting the data and just building the layout. This data does not depend on who requests it, it contains the usual content and id, which I use in the delete / edit button
So far, my last option was just the usual hiding / showing content, as you suggested
Level 75
@deekepMaks but if it's the authenticated user, then you can pass that in the Json response, that would be the condition I mentioned. You need a condition passed in that response to determine whether to show or hide buttons.
Level 35
A little hard to give much advise when we can't see any of your code, but why not pass a isUser boolean field with your json response. Then if the user is the profile user you can construct the buttons, otherwise don't.
Level 122
DONT do this in Javascript. The user can inspect the entire network request and fake other requests to download the details of every user
Level 1
@Snapey The information does not contain anything private, it can be seen by everyone
Please or to participate in this conversation.