Client-Side Scripting

The final section of this chapter takes a brief look at client-side (ie., browser) scripting.

Suppose you have a form with two tabs and a bunch of data controls. When the user clicks the Save button, the script checks that the data controls contain valid data, and if not, switches to whichever tab contains the offending controls. Only if everything is OK is the data actually saved. This will work correctly if you export the form and run it under RekallWeb. But, it is a bit of a pain for the form to be submitted, and for the server to reload data from the database, only to find that some data control is invalid, at which point the data is passed back to the browser unchanged, except for a popup message that warns of the invalid data.

To get round this, RekallWeb adds a split between server-side and client-side scripting. Server-side scripts are implemented in python, and run inside RekallWeb. Client-side scripts are implemented in JavaScript and run within the web browser. Also, RekallWeb provides a mechanism whereby the execution of a client-side script can control whether the form is submitted to the web server and the server-side script then executed.

In the above example, the client-side script would do all the verification work, and only trigger the submission if the data controls are valid; hence, the user's time will not be wasted on a server-and-back trip if the data is invalid. Of course, you might want to repeat the verification server-side, as a protection against malicious interference, but if the user is trying to hack your system, a server-and-back delay is just fine! The transfer of control from the client-side to the server-side is also quite simple; where an event has both client-side and server-side scripts, if the client-side script returns a true result then the form will be submitted and the server-side script executed (and if the result is false, nothing is submitted).

This is, by the way, no restriction on combinations of client-side and server-side scripts. You can have an event which has a client-side script only, and vice-versa.

So that the same forms can execute in Rekall and RekallWeb, Rekall will run the same client-side and server-side scripts itself, so that the form should execute the same. This uses the KJS scripting engine as well as the python engine. This has been ported to both Windows (fairly easy) and OS/X (easy-peasy), so this functionality is available on all platforms on which Rekall runs (and in bit the KDE and QT-only Linux versions).