0

I have a function called 'delete' like this : 

<div onclick="delete($post_id, $_SESSION['id']">somelink</div>

function delete(post_id, session_id) {
  var p_id = post_id;
  var s_id = session_d;

  $.ajax({
    url:"delete.php",
    type:"POST",
    data: {  
      p_id: p_id,
      s_id: s_id
    },
  });
})

delete.php is a page to delete the post = p_id which was added from user id = s_id.

My problem is any user can delete any post for only the console when typing in it the function 'delete();' with parameters it called and delete posts!

Any ideas, please.

Rory McCrossan
  • 331,213
  • 40
  • 305
  • 339
kimo
  • 39
  • 4
  • 6
    You cannot prevent this. The only solution is to validate the request on the server by ensuring that the current user has access to the entity that is going to be deleted – Rory McCrossan Sep 11 '17 at 15:00
  • 1
    Never, ever, ever trust data sent to you from end users - you will always need to validate any request that is sent to your server. First define which users are allowed to perform which actions and then you'll need to build a security mechanism around these actions to only allow authorized users to perform special actions. – Lix Sep 11 '17 at 15:01
  • Check https://stackoverflow.com/questions/21692646/how-does-facebook-disable-the-browsers-integrated-developer-tools – FieryCat Sep 11 '17 at 15:02
  • @FieryCat - that warning can just as easily be ignored. I don't think that this is what the OP is asking here... – Lix Sep 11 '17 at 15:03
  • thanks ....so I must change the onclick from javascript to jquery and don't declare the functions in my script file ? – kimo Sep 11 '17 at 15:06
  • FYI, jQuery IS javascript... – takendarkk Sep 11 '17 at 15:08
  • There is only 1 way to stop unauthenticated users executing your functionality - remove it entirely from the internet! The ONE way to properly secure this functionality is to use authentication & authorization. The answer is too broad for Q/A format here. – Jamiec Sep 11 '17 at 15:10
  • @csm_dev I know it ssame but I think to change the onclick() and dont declare the functions but make the functions inside like this $('#id').onclick(){ function....}) – kimo Sep 11 '17 at 15:12

3 Answers3

2

You can not. Nor should you.

You should always assume that data from the client side is corrupted and should be treated accordingly. That includes form data, or in this case, a AJAX request.

This means that you have to apply validation at the server side, let PHP do it for you. E.g.: Limit the number of posts you can delete per X time. And double check that the post actually belongs to the person who is deleting it.

The reason you can't do this, is because you create javascript which is clientside. If you create a function to prevent changing the code, the client can alter the code on their machine to ignore that. You could make a function to check of the function to check is changed, but again; client can change it.

Community
  • 1
  • 1
Martijn
  • 15,791
  • 4
  • 36
  • 68
  • can I change the `onclick();` to `$('#id').onclick(){ function....})` to protect the directly call from console ? – kimo Sep 11 '17 at 15:19
  • Hm, not really. It is better practice so you should do it anyway, but it will hardly matter. If you have someone skilled with JS, it will hardly be a problem, *whatever you come up with* – Martijn Sep 11 '17 at 15:20
-1

Unfortunately you can't. What you need to make sure though is making the function safe on the server which, in simple terms, boils down to

  1. Validating every request and input parameters on the server so that people won't be able to manipulate or change server side data from client side.
  2. make sure all data that you send to the client is originated from server as well. one of the ways to prevent calling a function from client side is NOT to expose your methods in the global scope. and remember if your code is very critical and important, always move it to server-side. it is not a good practice to cover application design issues with programming workarounds. calling functions from client side shouldn't be an issue if the program is designed right.
Jamiec
  • 133,658
  • 13
  • 134
  • 193
Ramin Ahmadi
  • 619
  • 5
  • 13
-2

First of all, this is bad. You should have authentication.

However, you can do that:

(function() {
  $('#BUTTON_ID').on('click', function(post_id, session_id) {

    var p_id = post_id;
    var s_id = session_d;

    $.ajax({
      url:"delete.php",
      type:"POST",
      data: {  
        p_id: p_id,
        s_id: s_id
      },
    });
  })
})();

And add "BUTTON_ID" as id for your button.

Not that even that way, it is still not secure.

With this way, you can't call delete from the console. But someone can look into the source code and copy your ajax call and paste it into his console and it will works. It is not a good way to prevent people deleting your posts.

You should read about web application security. You should have an authentication process with tokens that expires after x time. Tokens will authenticate the user and from here, you can check if the user have the right to delete post. If the user do not have the right, you don't show the button. Then if the user call it from it console, he will get an error from the backend server.

rm4
  • 711
  • 4
  • 15
  • 2
    This will NOT Stop someone calling the delete functionality in the question! Plus the fact jQuery's click handler wont magically pass those 2 id's to your function. All in all, a bad answer im afraid – Jamiec Sep 11 '17 at 15:08
  • @Jamiec Of course it will. It will remove delete function from the global scope. Try it yourself, function is not accessible that way. – rm4 Sep 11 '17 at 15:11
  • Still clientside, so still 'hackable' – Martijn Sep 11 '17 at 15:12
  • And still exposes the ajax request needed to make the request. You need nothing more than an http client to still call it. I re-iterate, the only way to secure this is server-side. – Jamiec Sep 11 '17 at 15:12
  • 1
    *Everything* clientside can be changed. – Martijn Sep 11 '17 at 15:12
  • Why so many downvote? The question is not how making his website secure. The question is about preventing user to call the delete function. Still I said that this was a bad idea. – rm4 Sep 11 '17 at 15:14
  • Because you're giving the OP a false sense of security. Youve added nothing by hiding the method from global scope. Scope is irrelevant. Insecure functionality is still insecure after this change. – Jamiec Sep 11 '17 at 15:15
  • Will edit to put more enphasis on security side. But the OP was asking how to prevent people from calling delete function. This is possible and I just explained how. – rm4 Sep 11 '17 at 15:18