views:

184

answers:

1

Rails 3 app.... I have the following jQuery which is working:

$.ajax({
    url: '/navigations/sidenav',
    data: "urlpath=" + urlpath,
    success: function(e){
        $("#sideNav-container").slideDown("slow");
    }
});

urlpath can be paths like '/' or '/projects' or '/authors' stuff like that.

My question is how do I grab that urlpath variable in the controller so I can use it in my view to determine what sidenav to return to the user?

Thanks

+1  A: 

Pass in the urlpath in a hash for the "data" key. Like so:

$.ajax({
    url: '/navigations/sidenav',
    data:{"urlpath":urlpath},
    success: function(e){
        $("#sideNav-container").slideDown("slow");
    }
});

This will then pass urlpath in the params object, that you can access from your controller. So you can simply do

params[:urlpath]

and you can get the urlpath you passed in. :)

pushmatrix
Any worries about XSS SQL Injection etc with this? As it just takes a params? Also, that seems to be encoding the URL, how do I decode it in the backend Rails app?
WozPoz
Is the urlpath entered by the user? Also, is it encoded before it gets sent through ajax, or is it encoded once it reaches the controller?
pushmatrix
Well it's not entered by the user but it's taken from the browser URL which a user could modifiy. A user could also post an invalid variable to try to hack the system right? Just curious if params safe guards against that or if I need to add something extra?
WozPoz
I was wondering if the urlpath was entered by the user to figure out where the encoding was happening. I made a sample app that passes a url through the data attribute, and it was not encoded. As for XSS, I don't believe there is any risk. How will you be determining which sidebar to render? With a simple switch or if statement that looks at the urlpath?
pushmatrix
WozPoz
There shouldn't be an issue with XSS since the params[:urlpath] returns a string, and as such there is no way of its contents being 'executed'. Had you been directly passing the string into the database, then that'd be a different story.
pushmatrix
Also, rails 3 is quite lovely and will escape html and javascript for you.
pushmatrix