3

I want to pass in a jQuery command (in the form of a string) from server-side JS to client-side js. This allows me to modify client-side DOM stuff from the server-side.

Function:

$("textArea").attr("disabled","true");

What I want to do:

$['$("textArea").attr("disabled","true")']();

Throws an error. Thoughts?

Shazboticus S Shazbot
  • 1,289
  • 2
  • 16
  • 27
  • 1
    _This allows me to modify client-side DOM stuff from the server-side._ This is not the right way. – Ram Apr 15 '13 at 22:58
  • 1
    near duplicate of http://stackoverflow.com/questions/15936011/calling-a-jquery-method-named-in-variable/15936215#15936215 but like undefined says, this just smells wrong... – Alnitak Apr 15 '13 at 22:59
  • It's a javascript chatroom. Disabling of html / dom elements must be done client-side. Trying to prevent any chatroom guests from fiddling with their browser element inspector - which can allow them to make posts even if they're "muted" – Shazboticus S Shazbot Apr 15 '13 at 23:03
  • Not sure why people are downvoting this question. It's perfectly legit. @Alnitak that's not a comparable situation. I can't break up this string client-side without revealing its functionality – Shazboticus S Shazbot Apr 15 '13 at 23:04
  • 1
    @ShazboticusSShazbot You can't rely on JS hacks to implement security. Users will _always_ find a way around them. – Alnitak Apr 15 '13 at 23:04
  • Just have a server-side js chatroom. Would be nice to implement a mute system for moderators. But if the users can simply edit their client-side DOM / JS, it's not particularly secure. The way I have it set up, if they mess with the textarea, it'll just prevent them from posting anyhow. I'd really prefer to leave this all in JS as opposed to bringing in other languages or applets – Shazboticus S Shazbot Apr 15 '13 at 23:10
  • A jquery solution will be `jQuery.globalEval()` http://api.jquery.com/jquery.globaleval/ – Ari May 03 '15 at 14:19

2 Answers2

11

You could use the eval-function on the client-side:

This will execute your javascript immediately:

eval('$("textArea").attr("disabled","true")');

But, as said in the comments, be careful with what you do as this is a very crude method.

Also, in terms of security, you don't really gain anything, because one could still open the dev-tools and remove the disabled attribute

Kenneth
  • 28,294
  • 6
  • 61
  • 84
  • Trying now. Yes, that I've already realized. The disabled setting of the textarea is only one setting. Serverside, their name is dropped into an array of users that are unable to post. I just need some security + indicators to the user that indeed they have been muted. Btw, not the only visual that indicated they have been muted. But it's an obvious one. – Shazboticus S Shazbot Apr 15 '13 at 23:13
2

Alternatively, you could break your string up into multiple strings passed from the server. For example:

// variables passed from the server
selector = 'textArea';
method = 'attr';
arguments = ['disabled', 'true'];

Then you could evaluate it this way:

$(selector)[method](arguments[0], arguments[1]);

Of course, if the number of arguments needs to be dynamic it would get a bit trickier.

chasingmaxwell
  • 43
  • 3