0

Context (Long Story Short):

I am using a PHP script and the $_POST variable to handle certain ajax POST requests from a view template. It needs access to database connector classes which can be accessed within controller.php, or from the associated view.html.php view class.

Short story long (ts;dr):

My current problem is that I can't include the files within my script because of the line:

defined('_JEXEC') or die('Restricted access');

The solution I thought of was to make a separate connector class which the view class can give its instance. Then the POST request handling script can fetch the instance from the connector class, since it doesn't need the restricted access line.

Basically: ViewClass -> InstanceConnector <- -> requestHandler.php <- AJAX

The problem with this is because the script is well... a script, it can't store variables outside of its own run-time, so the InstanceConnector class needs to store a singleton reference to itself for the script to access. Which I know is evil for polluting the global namespace...

This is mainly a general concern than a direct question. I'm assuming there is a Joomla framework in place for doing the requests (Although JRequest seems to be deprecated). However I could see other situations where this problem could come up... not being able to pass around references because of the restricted access.

If you haven't noticed, I am quite new both to Joomla! and full stack dev, so any veteran advice would be greatly appreciated. Has anyone else experienced related issues? I would like to stay within the MVC pattern as best I can and I have a sneaking suspicion that might not be what I am doing...

Improve this question

1 Answer 1

Reset to default
2
  1. Use Joomla's AJAX interface... (JRequest was actually a unified mechanism for data filtering etc of post and get requests…
  2. Never use raw globals ($_POST, $_GET etc) you leave yourself open to security problems... using Joomla's robust JInput features to access values passsed in…

com_ajax started out here... and this was a good example at the time — I think it's still relevant.

Improve this answer
2
  • 1
    Thank you for the point in the right direction! I was aware of the vulnerabilities of the _POST and _GET but figured I had to include my own or 3rd party filters to clean up the data. For com_ajax and JInput, should I use one rather than the other or does com_ajax simply make use of JInput?
    – Patrick Noble
    Aug 12, 2016 at 15:10
  • 1
    Sorry about the delay in replying — you would use JInput when retrieving any variables you're passing into your extension via com_ajax. Effectively by time it gets to your code all the request vars (via post or get) have been assembled in JInput :)
    – Craig
    Aug 16, 2016 at 5:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.