Joomla component development (version 3.3.3)

Question

I have a component that I'm building in joomla that I want to render information from ONLY when the component is the calling agent.

Example: I have a url http://domain.com/index.php?option=com_mycomp&view=myaccount from within there I want to have a pop/overlay that renders the url: http://domain.com/index.php?option=com_mycomp&view=mykey&user_id=123

I know there has to be a way to only let the "mykey" view render when called from itself and not allow direct access. I've looked into the login module and using JHtml::_('form.token'). Not sure if this is the "best practice" way to achieve this or if that would even work.

Any help is greatly appreciated.

Joomla version: 3.3.3

To clarify, you want to make sure a user can't directly type the URL of your overlay/popup into the browser to access the view? — Brian Bolli
Yes that's correct. Since I've posted this I've implemented a version that checks a variable in the user's state, I'm still not sure of this is best practice. I can't use acl bc it's not based on user grouping, it's based on whether a user has inputted a correct answer to a previous question. — Chad Caldwell

Brian Bolli Brian Bolli · Accepted Answer · 2014-08-27T05:01:46

Using SSL, login validation for user session and validating the session each request I would consider a best practices. Joomla provides a mechanism to display a form token field:

 echo JHtml::_('form.token');

If you need to attach the token to a URL. The tmpl=componen parameter is important when wanting to render HTML snippets. This flags Joomla to render only the components view, otherwise you would get your entire website; menus, modules and all back:

 echo JRoute::(JUri::root() . '?option=com_mycomponent&view=userscreen&tmpl=component&' . JUtility::getToken() . '=1');

And on the other end of the request server side, using the above path as an example, could be received with the controller:

class MineControllerUserScreen extends JControllerLegacy
{
    public function display($cachable = false, $urlparams = array())
    {
        // Validate the session is valid, die if isn't
        JRequest::checkToken() or die( JText::_( 'Invalid Token' ) );

        // Load the current user object for the active session if needed
        $user = JFactory::getUser();

        // Load the Session object for further validation if needed
        $session = JFactory::getSession();

        // Load sanitized items from POST and GET
        $jinput = JFactory::getApplication()->input;
        $answer = $jinput->get('user_answer', null, 'string');

        // You are satisfied this person is allowed to get this
        parent::display($cachable, $urlparams);
    }
}

This use case should be handled within the controller. The above example lists many possible options for getting secure data from Joomla you could use; but for your case I think incorporating your existing question/answer as a POST variable request, which passes both token and user validation should do the trick.

Here's a general Joomla document on secure coding guidelines.

http://docs.joomla.org/Secure_coding_guidelines

Joomla component development (version 3.3.3)

1 Answers