We Keep Coding

how safe is to pass the 'user' to javascript Ajax in laravel?

I already asked about this situation but when you pass the data directly to the view like this:
you get the user with $user = Auth::user(); and then send it to the view with return view ('somepage')->with('user',$user); the browser will get all user data in the view (uername, password, user_id etc..).
And found out it should be safe. Now I am thinking what if you instead are passing it to a script that is in charge of updating the view?
Like this:
return Response()->json($user);
You are firing a json in the wild that gets into the script as data, so can a third party have access to that json data too?

No, you DO NOT want to pass any sensitive data to a script or through JSON. Both of these resources would be viewable from the client side.
You can however, remove the sensitive data from your object before serializing it to JSON and passing to the browser.
In your Eloquent models, add a $hidden property - this property is an array of attributes that will be removed when serializing the model to JSON.
So, your User model will look like:
<?php
namespace App;
use Illuminate\Database\Eloquent\Model;
class User extends Model
{
/**
* The attributes that should be hidden for arrays.
*
* #var array
*/
protected $hidden = ['password'];
}
Then, the password will be removed and not accessible from the client.
Docs: https://laravel.com/docs/5.2/eloquent-serialization#hiding-attributes-from-json

Call Sitecore controller method from JavaScript (MVC)

I have a controller with a function ShowEvents(EventCategory eventCategory). Is it possible to call this function from client-side JavaScript? I know that I can retrieve items from the database using the Sitecore.Services.Client (SCC), but is it possible to actually access methods? Maybe through the controller rendering, if that's possible?
Here is an example of a method I want to call:
public class EventListController : Controller
{
public ActionResult ShowEvents(EventCategory eventCategory)
{
var repository = new EventListRepository();
var eventPages = repository.GetEvents(eventCategory);
var eventListViewModel = repository.GetEventListViewModel(eventPages);
return View("/Some/Path/, eventListViewModel);
}
}
This is on Sitecore 7.5 MVC

You can Post to controllers from the client side using the format
/api/sitecore/{yourcontroller}/{action} in your case this would be /api/sitecore/eventlist/showevents passing the eventCategory as the data.

yes you can reach every function with
A separate view page named with same name of it and the view pages
will be written with RAZOR language which is composed of c# and html
and surely you can write javascript within the html code.
with the Asp.net and MVC5
here an example :::
http://www.asp.net/mvc/tutorials/mvc-5/introduction/getting-started

You can use the below format for call the Action method in sitecore project.
Sitecore have own route to manage the action method which is used as API. You can use it for Ajax call from the fronted.
/api/Sitecore/{controller Name}/{action method name}
Just post your data as request in data object and cosume the url in above format. It's act like API.

JSON and OData model in one application. JSON model binding sends request to OData

I'm working on an application which uses different models to show a variety of data in an UI5 application.
In Component.js, I define and bind an OData model for general purpose to the application.
var url = my.app.namespace.util.Formatter.configUrl("serviceUrl");
var dataModel = new sap.ui.model.odata.ODataModel(url, true);
For a table, I use a JSON model, which is bound in the XML view.
Controller for XML:
_updateTable: function(data, tableId) {
var table = this.getView().byId(tableId);
var jsonModel = new sap.ui.model.json.JSONModel();
jsonModel.setData(data);
table.setModel(jsonModel);
},
XML:
<Table
id="supplierTable"
fixedLayout="false"
headerText="Lieferantenübersicht"
items="{/results}">
My problem is that the /results is creating an unnecessary OData call, which I would like to prevent.
I tried to name the JSON Model like this:
var jsonModel = new sap.ui.model.json.JSONModel("tableModel");
that I use in the XML view:
items="{tableModel>/results}">
But I get the following error:
<p>Problem accessing /EIM_POSTING_RATE/tableModel. Reason:
<pre> Not Found</pre></p><hr /><i><small>Powered by Jetty://</small></i><br/>
Any recommendation on how to prevent the OData call?

To make use of a named model you need to register it to the view (or the table) in the following way.
this.getView().setModel(jsonModel, "tableModel");
You need to adapt the property binding to make use of this model. For example:
<Text text="{tableModel>text}"/>
You trigger an automatic request by using
new sap.ui.model.json.JSONModel("tableModel");
because the JSONModel either expects an object representing the data to be stored or an URL which is used to load data.

Cleanly passing large JSON array from Laravel to Javascript

So in my controller logic, I build up a large array of data, which I json_encode into a variable which is passed to my view. However, I want this data to be sortable on the client side using JavaScipt--I don't think the details of how the sorting is done are relevant but I'm curious what the best way is to get my array from PHP to Javascript. Currently, I'm thinking of just having a tag in my html like
<script type="text/javascript">var jsonData = <?php echo $myData ?>; </script>
where myData is the encoded array I made in PHP, and then jsonData is available for me to use anywhere else.
However, this would mean the entire ugly array would show up in the source code of my page. This isn't a security concern or anything, but I feel that there must be a better way to do this that's not quite as "ugly".
Any advice is appreciated.

You have two options.
If you don't want 'ugly' HTML source, you can query your application with ajax and have your json array be stored in a variable. This can be accomplished with a simple route and controller method.
In your routes.php
Route::get('api/myData',array('as'=>'api.myData','uses'=>'MyController#getMyData'));
In your MyController.php
public function getMyData() {
return whateverYouWant();
}
You can then do an ajax request to route('api.myData')
The route method is a global function which is available in your view. It will take the named route, api.myData and generate a URL for it.
The other option is as you described, passing the array to your view.

How do I use javascript variable to filter Model in cshtml

I have a javascript function that will calculate and return a status, then I want to use it to filter my model. But it seem it doesn't allow me to do this in cshtml file.
var status = GetStatus();
if (status != 'All')
{
data = #Html.Raw(Json.Encode(Model.Where(p => p.ConfirmedStatus == status)));
}
else
{
data = #Html.Raw(Json.Encode(Model));
}

You cannot use JavaScript to filter model data that you passed to your View in this way. The model data is bound to the view on the server, before it is sent to the client. This means that you cannot use LINQ inside of a JavaScript function like you have posted above because the server is already done with the file and sent it on to the client. After the model data is bound, the entire view is sent to the client which is where JavaScript is processed.
There are other options such as partial page rendering (making an AJAX call to get the filtered data back to the server) or you could look at some jQuery plugins that filter data inside of a table such as http://jquery-plugins.net/jquery-filter-table-plugin. It really depends on your use case.