CODEWITHSUNDEEP
phphtmllaravelforms
Sociopath
Sociopath

Reputation: 295

Problem on sending hidden value from a form

I'm creating a forum on Laravel that contain sections, threads and comments. Users can create threads on sections, and comments on threads. My problem is when user is creating a thread on a section I'm sending the section ID via hidden input value and if user edit that value he can post in other section.

What would be the best practice to do that? Or is there any way to get that id from controller or something like that? thanks

Upvotes: 0

Views: 33

Answers (1)

KIKO Software
KIKO Software

Reputation: 16751

Hidden form input values cannot be used to really hide something from the user. They are only hiding the value visually.

If a user is only allowed to edit their own thread, then you should check this in two places:

  1. When the user enters the editor for that thread.
  2. When the user submits an edit for that thread.

The check is simple. The user should be logged in, so in the session for that user you have stored the user id. In your database row for a threat you have also stored who wrote that thread. This is likely to be the user id. So you can compare those two values: They should match.

Upvotes: 1

Related Questions