In terms of security, I see web apps almost every day - on other platforms where sql injection and helpful error messages, can lead a hacker into many so called secure sites and databases - fortunately, most people know very little about Domino. In this case exposure is minimal and still does not overide Domino database security.

Yours articles helped me a lot in order to learn to develop in Domino platform.

I have found your articles on Yahoo-ext library very interesting .

You can enclose the database, or mailed me, to unload to the study ends?

Thanks in advance.

p.s. Sorry for my english

and greetings from Venice

Out of curiousity, I tried this on my Notes workspace and discovered that I could "drag" database icon(s) without using the mouse, to another location on my workspace including other tabs. I can't count how many times I've started a mouse drag to another workspace tab only to have overshot the tab and have every location turned into a 'no-drop' zone along with crossed out circle as a mouse pointer.

It's not ground breaking, but definitely a technique that I'll use from now on.

It's running a blog that does it to you. You become all defensive and bite back at anything at all. I think I talked before about how it sometimes feels a bit like there's a desire to prove me wrong. Probably just me being paranoid though.

Having re-read your post today I see it was all well meant and constructive commentary. My reply has a tone to it that I didn't really intend. Such is the problem of this form of communication.

Anyway, don't pretend you've never written an app where - for security - you've relied on user ignorance. Come on, we've all done it.

Jake

Pardon my arrogance.

Tommy. Yeah, yeah, very impressive. Obviously it's a doddle to "hack" it, but it's not meant as a replacement for Notes-side access control. If they' have reader access they can do what they like to the DEXT properties -- it's not going to magically give them author rights to the database now is it!?

Horses for courses init.

If you're interested in learning about the scope of "this", Douglas Crockford (the father of JSON) has written a simple but informative article about "Private Members in JavaScript": {Link}

To set full "client-side access". A simple bookmarklet will do.

javascript:(function(){access=YAHOO.DEXT.Session.User.Access; for(item in access){if(typeof access[item] === "boolean"){access[item]= true;}}})()

I would think that a greasemonkey-script, or a debugger like Firebug (using breakpoints) can help the user to override the access-variables before the layout is initialized..

If you don't expose any unsecured server-side agents/etc, this will not be a problem.

1. Read this: {Link}

In fact, the more time you spend reading quirksmode, the more this kind of thing will click. You might even consider buying a copy of PPK's book for reference.

2. One of the simplest functions in YUI is the namespace function, which is there to save the Y folks some typing. They use multiple levels of objects for namespacing, so if they want to create a new sub-library, they can start with:

YAHOO.namespace( 'foo.bar.baz' );

instead of:

YAHOO.foo = {};

YAHOO.foo.bar = {};

YAHOO.foo.bar.baz = {};

I hope that explains things a bit.

@Bill E:

I've had some spirited discussions with people about the security issue. What it boils down to, in my mind, is that the information coming out of the server for this sort of thing is the same, on the wire, as what you're pulling down in a regular domino-generated web page. Having it in JS or JSON is no better or worse than plain HTML. If you're worried, use HTTPS. If you're still worried, pack the script before you send it.

What I need to do though is take a step back and start to understand more of what I am doing in terms of core JavaScript. For example, the "this" keyword is causing me some confusion and I find myself guessing how code works instead of understanding how. Always dangerous.

I wouldn't bother using YAHOO.namespace(), though, because you're only going one level down, and you're reassigning the namespace anyway. Just use "DEXT = {}", and you've made it simpler while saving youself an object.

I know most people are glued to what we've been able to do with the web UI of Domino apps using Ext. However, I hope everyone realizes how cool this other is. IBM wouldn't do it for us but you and I and maybe some others will and that is to build "JavaScript Classes" for the Domino Objects.