Display result of javascript function in column

Question

i am trying to display the results of the following javascript function in a column,using the renderer property to refer to the function however am not seeing the results...not sure what i am missing. tried using both the column renderer property and record field convert property

the purpose of the function is to mask the values in the restriction code column for example 1234 becomes 12**

Here are the snippets. Thanks in advance for any ideas.

<script type="text/javascript">
 var start = function RenderRC(value) {

         if (value.toString.length > 2) {
        var value = value.substr(0, 2) + Array(value.length - 2 + 1).join("*");
        return value;
    } 
};
</script>


     <Fields>
     <ext:RecordField Name="RestrictionCode" />
    </Fields>

    <ext:Column Header="<%$ Resources:Text,RestrictionCode %>"       DataIndex="RestrictionCode" Fixed="true" Width="200" align="Center">                                                    
    <Renderer Fn="start" />
    </ext:Column>

     <LoadMask ShowMask="true" Msg="<%$ Resources:Text, RetrievingUsers %>" />

Answer 1

Try

txtRestrictionCodeID.toString();

You didn't call the function so what was assigned to Rcode was the function instead of the result of the function.

Answer 2

The answer provided by @Esailija is correct, you just need to call .toString() instead of .toString.

I would like to point out another [security?] issue you might be overlooking with your technique. You are attempting to format a value [RestrictionCode] to obfuscate it from your users, but that value still remains available un-obfuscated client-side, just not visible.

With a little JavaScript run in a browser tool such as Firebug, a user, in their browser, could retrieve any (and all) those data Store values and see them in plain text.

It would be best to format the RestrictionCode value server-side, and never send the un-formatted value to the client.

If you still require the value client-side, in order to pass back to the server-side... first encrypt the value on the server-side before sending to the client, and just pass the encrypted value back-and-forth between the client/server. The server can decrypt the value, and client just sees some encrypted string value, which they cannot (should not be able to) decrypt.

Hope this helps.