clients should not be able to change data on the server without validation; force server-side "setters" about now HOT 5 CLOSED

Hey Tom,

We've added the clientWrite option which allows you to stop clients from writing to the server.

 nowjs.initialize(httpServer, {clientWrite: false});

However changes are rejected on the server side so it is important to make sure that any type of data sent to the server is rejected if it surpasses a certain size

from now.

Sweet, it does seem like a big security issue with having clientWrite as true.

So with:

nowjs.initialize(httpServer, {clientWrite: false});

What's the best practice equivalent of:

now.receiveMessage = function(name, message){
  $("#messages").append("<br>"+name+": "+message);
}

I couldn't get the following to work:

Server:

/**
 * Meet the client
 * @return {integer} id
 */
everyone.now.meet = function(options,_callback){
    // Apply Options
    if ( typeof options.notify === 'function' ) {
        this.now.notify = options.notify;
    }

    // Next
    _callback(this.now.id);
};

// ...
everyone.now.notify(n);

Client:

// Now
window.now.ready(function(){
    // Bind Now
    window.now.meet(
        // Options
        {
            notify: function(_state){
                if ( _state !== me.currentState ) {
                    me.reset();
                }
            }
        },
        // Callback
        function(_id){
            // Apply Id
            document.title = me.id = _id;

            // Init Sync
            me.reset();
        }
    );
});

Returns error on server:

TypeError: Object #<Object> has no method 'notify'
    at Object.<anonymous> (/Users/balupton/Dropbox/Server/public_html/sites/nowpad/server.js:180:16)
    at Object.<anonymous> (native)
    at Object.remoteCall (/usr/local/lib/node/.npm/now/0.5.2/package/lib/nowServerLib.js:49:19)
    at [object Object].<anonymous> (/usr/local/lib/node/.npm/now/0.5.2/package/lib/nowServerLib.js:173:46)
    at [object Object].emit (events.js:64:17)
    at [object Object]._onMessage (/usr/local/lib/node/.npm/socket.io/0.6.17/package/lib/socket.io/client.js:58:10)
    at Parser.<anonymous> (native)
    at Parser.emit (events.js:64:17)
    at Parser.parse (/usr/local/lib/node/.npm/socket.io/0.6.17/package/lib/socket.io/transports/websocket.js:195:12)
    at Parser.add (/usr/local/lib/node/.npm/socket.io/0.6.17/package/lib/socket.io/transports/websocket.js:182:8)

from now.

@balupton

Hmm I believe there is an outstanding bug with nested functions being passed as parameters. So options.notify is not being actually passed the server

from now.

@ericz

Yeah, passing the notify function as an argument rather than inside an object worked great. Would you like me to file a bug for sending objects to the server?

from now.

Yep that'd be very helpful, thanks!

On Sun, Apr 24, 2011 at 8:32 PM, balupton <
[email protected]>wrote:

@ericz

Yeah, passing the notify function as a argument rather than inside an
object worked great. Would you like me to file a bug for sending objects to
the server?

Reply to this email directly or view it on GitHub:
#44 (comment)

510-691-3951
EECS Student at UC Berkeley
http://ericzhang.com

from now.