title: Can someone edit javascript file offline to run malicious code?
body: <p>I am worried about something related to javascript files of my website, I am not sure if this is doable.</p>
  
  <p>Js files will be downloaded when someone visits a website, what if someone edited the downloaded js script and inserted his own code, then refreshed the website. In the new refresh the website will read the edited Js file and will run the malicious code. The malicious code might be used to run some code at the server in normal ways.</p>
  
  <p><strong>Example:</strong></p>
  
  <p>A user is only allowed to post an article in his page:</p>
  
  <p><strong>HTML</strong></p>
  
  <p>Article form will only show for the user in his page.</p>
  
  <pre><code>&lt;?php
  if( $user-&gt;id == $page-&gt;userID )
  {
  ?&gt;    
  &lt;form&gt;
  &lt;h1&gt;Add new article:&lt;/h1&gt;&lt;br /&gt;
  &lt;textarea name="articleText" cols="65" rows="3"&gt;&lt;/textarea&gt;
  &lt;input class="SubmitArticle" id="&lt;?php echo $userPage-&gt;id; ?&gt;" name="SubmitArticle" type="button" value="Submit article" /&gt;
  &lt;/form&gt;
  &lt;?php
  }
  ?&gt;
  </code></pre>
  
  <p><strong>Javascript</strong></p>
  
  <pre><code>$(".SubmitArticle").click( function(e){
      var targetPage = $(this).attr('id');
      var thisForm = $(this).parent();
      var postData = thisForm.serialize() + "&amp;targetPage=" + targetPage;
  
      $.post(document.location, postData, function(data) {
          $('#mainDiv').html(data);
      });
  });
  </code></pre>
  
  <p><strong>PHP</strong></p>
  
  <pre><code>if( isset($_POST["SubmitArticle"]) )
  {
      $pageID = $_POST["targetPage"];
      $text = $_POST["articleText"];
  
      PublishArticle( $pageID , $text );
  }
  </code></pre>
  
  <p><strong>Malicious Code:</strong></p>
  
  <p>Code inserted in JS file to write article on other users pages (which is not allowed), the attacker reads page id from html element using view page source (lets say page_id=12):</p>
  
  <pre><code>postData = "SubmitArticle=1&amp;targetPage=12&amp;articleText='Muwhahahah'";
  $.post(document.location, postData, function(data) {
  });
  </code></pre>
  
  <p>What is the solution if this is possible?</p>