Submit a view instead of redirect to another view

Question

I have 2 views namely students and student. The students view will list all the students and student view is to show the details of the student. These 2 views are accessible for all staffs in the school to view their students.

Currently I using an anchor link in the students view by passing the student_id as one of the argument in href to the student view. The problem here is if the staff simply goes to the URL and changes the student_id to some other number then the staff able to view the other student details.

I want to stop this in a easier way instead of checking again on the database whether the particular student reports to the logged in staff.

I thought of something to do with Joomla form.token and submit the first view while clicking the student name and the next view can validate the token and show the full details.

I am not sure whether it makes sense but I thought this will make my life easier instead of writing several validations.

Answer 1

Answering my own question... I should have spend some time in google before asking my question.

Joomla supports CSRF anti-spoofing and it is explained in How_to_add_CSRF_anti-spoofing_to_forms

Since I am using GET method I should use the below while forming the HRF

<?php 
echo JRoute::_( 'index.php?option=com_example&controller=object1&task=save&'. JSession::getFormToken() .'=1' ); 
?>

and in the other page check as below

JSession::checkToken( 'get' ) or die( 'Invalid Token' );