Question

I wonder if there is a way using Jquery to detect if a user is an administrator and allows them to click a link.
For all on admin users, there is a e.preventDeafult() active on said link.

Is that possible, anyone?

Answer 1

Since JS is run in the browser, there is no full-proof way to do this (your JS code can always be modified). But here are two solutions. The first is less full-proof than the second, but much simpler & offers a better user experience.

1. Have your php template echo a hidden div that contains a value (such as true or false) that your jQuery code can access to determine if the user is an administrator.

2. Have the link actually make an AJAX request. That way, the determination can be done by the PHP in the URL that the request is made to.

#1 is easier to hack because it provides two places to hack: 1) the DOM value (true or false) and 2) The code in the script itself (in case you didn’t know, this can be modified on the fly by the user).

#2 only offers the second of these scenarios.

BUT, it’s obviously more complicated, and since both are hackable and the user is someone trustworthy I assume (since it’s an admin), i’d just go with #1.

I actually do this kind of thing quite frequently on my Drupal site. Never in a place where it could create a security issue, of course (i.e. if making an AJAX request, I never trust that my JS is sending the right logged in uid to the server; instead, I always use global $user in the PHP code that is processing the request).