Editor > Selected columns only : Security sufficient to protect against tampering?

andrewmoir

Dear All,

I want the customer to only be allowed to edit columns : First name, Last name, Salary in the following example :

https://editor.datatables.net/examples/inline-editing/columns.html

This is done in this manner : { data: 'first_name', className: 'editable' },

Is this secure against abuse? Can someone abuse this to allow them to edit say another column ("Position")?

Shouldn't I be trying to prevent any acceptance or validation on the "Position" column in the server side script? ( Field::inst( 'position' ), )

Or is the javascript alone sufficient?

Kind regards Andrew

allan

Hi Andrew,

The Field::inst() is by default read / write. Use:

Field::inst( 'position' )->set(false)

to disallow writing to it.

Allan