Calling a ruby function on button click

[i-h8-github]

Hello all,

How can I call a ruby function when a button is clicked without requesting a new page?

[jeremyevans]

I'm not sure what you are asking for here, but I'm guessing you want to have a user click a button, and have some code executed on the server based on the button click, but not have navigation go to a new page. Assuming that is what you want, you would have to have javascript code on the page that overrides the default button behavior to submit the request via XMLHttpRequest or fetch to a route in your Roda application, and have that Roda route call the Ruby function, then (if necessary), return appropriate data in the response, and have the javascript handle the response.

[i-h8-github]

Thank you. That looks like more or less what Unpoly does, is that right? Seems they even have a Roda plugin ready to go, so I will be checking that out.

Thank you for your reply.

By the way, I really Like Roda (and many of your other projects) a lot. Thank you for your generosity.

[i-h8-github]

Oh, duh. Doesn't that also render the whole HMAC thing moot? At least if the only point is to know where to go back to after the post and both routes are within my domain?

[jeremyevans]

No, you still need the HMAC, because the form parameter can be modified by a malicious client (just as the Referer header can be). The main advantage of the form parameter over the Referer header is that all browsers will submit all form parameters, and you have more control over the parameter value.

[i-h8-github]

Then wouldn't I recalculate in the post block with r.params["path"] instead of r.referrer?

i.e.

<form method="POST" action="/test">
  <%== csrf_tag("/test", "post") %>
  <input type="hidden" name="path" value="<%= r.path %>" />
  <input type="hidden" name="key" value="<%= OpenSSL::HMAC.hexdigest(OpenSSL::Digest::SHA256.new, csrf_secret, r.path) %>" />
  <button type="submit">Test</button>
</form>

and

r.post do
  r.on "test" do
    key = OpenSSL::HMAC.hexdigest(OpenSSL::Digest::SHA256.new, csrf_secret, r.params["path"])
    if r.params["key"] == key
      r.redirect r.params["path"]
    end
  end
end

[jeremyevans]

Yes.

[i-h8-github]

Thank you.

You have been extraordinarily patient and helpful.