asp.net mvc 全局权限过滤器及继成权限方法
来源：互联网 发布：软件统计表 编辑：程序博客网 时间：2024/06/04 17:45
全局权限过滤器
//-----------------------------------------------------------------------// <copyright file="PermissionFilter.cs" company="STO EXPRESS, Ltd.">// Copyright (c) 2015 , All rights reserved.// </copyright>//-----------------------------------------------------------------------using System;using System.Collections.Generic;using System.Linq;using System.Web.Mvc;namespace DotNet.MVCInfrastructure.Filter{ using DotNet.Model; using DotNet.MVCInfrastructure.Attributes; using DotNet.MVCInfrastructure.Common; using DotNet.MVCInfrastructure.Enumerations; using DotNet.MVCInfrastructure.Models; using DotNet.Utilities; using DotNet.Business; /// <summary> /// 身份验证过滤器 /// /// 1、匿名访问 /// 2、登录就可以访问 /// 3、需要验证是否有菜单或按钮或资源的权限 /// /// /// 修改纪录 /// /// 2015-10-11 版本：1.0 SongBiao 创建文件。 /// /// <author> /// <name>SongBiao</name> /// <date>2015-10-11</date> /// </author> /// </summary> public class CheckPermissionFilter : IAuthorizationFilter { /// <summary> /// 认证和授权是两个方面 /// </summary> /// <param name="filterContext"></param> public void OnAuthorization(AuthorizationContext filterContext) { string pageUrl = filterContext.HttpContext.Request.Url == null ? "$$#$$" : filterContext.HttpContext.Request.Url.AbsolutePath; //OperateContext.GetThisPageUrl(false); //NLogHelper.Debug("CheckPermissionFilter:" + DateTime.Now + ",pageUrl=" + pageUrl); if (filterContext == null) { throw new ArgumentNullException("filterContext"); } if (filterContext.HttpContext.Request.Url == null) { throw new ArgumentNullException("filterContext"); } // 是否是Ajax请求 var bAjax = filterContext.HttpContext.Request.IsAjaxRequest(); // 注意 所有允许匿名访问的Controller，Action 都要设置匿名访问标签 // 只对 Action 做判断 // 判断 控制器 是否可以匿名访问 var controllerAnonymous = filterContext.Controller.GetType().GetCustomAttributes(typeof(AllowAnonymousAttribute), true) as IEnumerable<AllowAnonymousAttribute>; // 先判断控制器是否可以匿名访问 if ((controllerAnonymous != null && controllerAnonymous.Any())) { // 再检查Action 是否有登录检查标签 var checkLoginActionAttr = filterContext.ActionDescriptor.GetCustomAttributes(typeof(CheckLoginAttribute), true) as IEnumerable<CheckLoginAttribute>; if (checkLoginActionAttr != null && checkLoginActionAttr.Any()) { } else { // 如果没有 让他可以继续访问 因为把Controller 设置为 AllowAnonymous 了 return; } // 匿名就可以访问 无需验证登录状态 //return; } // 判断 Action 是否可以匿名访问 var actionAnonymous = filterContext.ActionDescriptor.GetCustomAttributes(typeof(AllowAnonymousAttribute), true) as IEnumerable<AllowAnonymousAttribute>; if (actionAnonymous != null && actionAnonymous.Any()) { // 匿名就可以访问 无需验证登录状态 return; } // 1、允许匿名访问 用于标记在授权期间要跳过 AuthorizeAttribute 的控制器和操作的特性 // 2017-03-06 检查OpenId 只需传来openId if (!string.IsNullOrWhiteSpace(filterContext.HttpContext.Request["openId"])) { string openId = filterContext.HttpContext.Request["openId"]; UserLogOnResult userLogOnResult = Business.Utilities.LogOnByOpenId(openId, true); if (userLogOnResult != null && !string.IsNullOrEmpty(userLogOnResult.StatusCode) && userLogOnResult.StatusCode == Status.OK.ToString()) { // 用户状态存储 OperateContext.Current.AddCurrent(userLogOnResult.UserInfo); } } else if (!string.IsNullOrWhiteSpace(filterContext.HttpContext.Request["AuthorizationCode"])) { // 2017-05-23 检查传过来的AuthorizationCode 支持code跳转登录 string authorizationCode = filterContext.HttpContext.Request["AuthorizationCode"]; string openId; if (BaseUserManager.VerifyAuthorizationCode(null, authorizationCode, out openId)) { // 用户状态存储 UserLogOnResult userLogOnResult = Business.Utilities.LogOnByOpenId(openId, true); if (userLogOnResult != null && !string.IsNullOrEmpty(userLogOnResult.StatusCode) && userLogOnResult.StatusCode == Status.OK.ToString()) { // 用户状态存储 OperateContext.Current.AddCurrent(userLogOnResult.UserInfo); } } } // 2、判断是否登录或登录已超时 需要重新登录 if (OperateContext.Current.UserInfo == null) { // 用户状态已过期 // 判断请求是否是Ajax请求 if (bAjax) { BusinessResultBase result = new BusinessResultBase(); result.Title = "未登录或登录已超时"; result.Status = false; result.StatusCode = BusinessStatusCode.LoginTimeOut.ToString(); result.StatusMessage = "请重新登录系统。"; var jsonResult = new JsonResult(); jsonResult.Data = result; jsonResult.JsonRequestBehavior = JsonRequestBehavior.AllowGet; filterContext.Result = jsonResult; } else { //filterContext.Result = new RedirectToRouteResult(new System.Web.Routing.RouteValueDictionary(new { Area="",Controller = "Account", action = "Login" })); filterContext.Result = new RedirectResult(BusinessSystemInfo.LoginUrl + "?returnUrl=" + pageUrl); } } else { // 用户状态未过期 // 3、拒绝某个账号登录当前系统 判断用户是否在拒绝登录的子系统中 //if (OperateContext.Current.IsDenyVisit()) //{ // if (bAjax) // { // BusinessResultBase result = new BusinessResultBase(); // result.Title = "拒绝访问当前系统"; // result.Status = false; // result.StatusCode = BusinessStatusCode.AccessDeny.ToString(); // result.StatusMessage = "您的账号不允许访问当前系统。"; // var jsonResult = new JsonResult(); // jsonResult.Data = result; // filterContext.Result = jsonResult; // } // else // { // filterContext.Result = new RedirectToRouteResult(new System.Web.Routing.RouteValueDictionary(new { Controller = "Prompt", action = "DenyAccess", bAjaxReq = false, message = "没有获取您拥有的权限菜单，请尝试重新登录。" })); // } //} //else if (OperateContext.Current.UserInfo.IsAdministrator) { // 超级管理员不检查权限了 return; } else { // 4、判断用户是否能够访问当前的controller,action // 5、判断登录状态 根据Controller或Action上的标签 某些功能只需判断是否登录 // 判断Controller上是否有CheckLoginAttribute标签 只需要登录就可以访问 // 实际上检查登录也不好，应该检查改Action是否是公开的 上面做为临时用 某些系统没有菜单或者没有配置的Action可以这样做 否则都必须配置菜单 // 判断Controller上是否有CheckLoginAttribute标签 只需要登录就可以访问的 var checkLoginControllerAttr = filterContext.ActionDescriptor.ControllerDescriptor.GetCustomAttributes(typeof(CheckLoginAttribute), true) as IEnumerable<CheckLoginAttribute>; if (checkLoginControllerAttr != null && checkLoginControllerAttr.Any()) { // 否则 没有设置 CheckLogin 标签的 就要验证 向下执行 到这里 除了设置 CheckLogin 的action 都要检查菜单访问权限 return; } // 判断action上是否有CheckLoginAttribute标签 只需要登录就可以访问的 var checkLoginActionAttr = filterContext.ActionDescriptor.GetCustomAttributes(typeof(CheckLoginAttribute), true) as IEnumerable<CheckLoginAttribute>; if (checkLoginActionAttr != null && checkLoginActionAttr.Any()) { return; } // 如果有 CheckActionPermission 就过 让CheckActionPermission处理 var checkPermissionActionActionAttr = filterContext.ActionDescriptor.GetCustomAttributes(typeof(CheckActionPermissionAttribute), true) as IEnumerable<CheckActionPermissionAttribute>; if (checkPermissionActionActionAttr != null && checkPermissionActionActionAttr.Any()) { return; } // 6、有些要判断是否有某个controller或 action的权限 通过获取的权限菜单进行比较 // 用户具有的菜单 var moduleList = OperateContext.Current.UserPermission;//.GetPermissionList(false); if (moduleList == null || !moduleList.Any()) { // 没有获取到任何菜单 if (bAjax) { BusinessResultBase result = new BusinessResultBase(); result.Title = "没有访问权限"; result.Status = false; result.StatusCode = BusinessStatusCode.AccessDeny.ToString(); result.StatusMessage = "没有获取到任何菜单，请尝试重新登录或咨询系统开发人员。"; var jsonResult = new JsonResult(); jsonResult.Data = result; jsonResult.JsonRequestBehavior = JsonRequestBehavior.AllowGet; filterContext.Result = jsonResult; //var jsonResult = new JsonResult { Data = new BaseModels { IsError = true, ErrMsg = "请先登录！", ErrCode = "unlogin" }, JsonRequestBehavior = JsonRequestBehavior.AllowGet }; //filterContext.RequestContext.HttpContext.Response.Write(JsonConvert.SerializeObject(result)); //filterContext.RequestContext.HttpContext.Response.End(); } else { //filterContext.Result = new RedirectToRouteResult(new System.Web.Routing.RouteValueDictionary(new { Area = "", Controller = "Error", action = "NoAccess", bAjaxReq = false, message = "没有获取您拥有的权限菜单，请尝试重新登录。" })); filterContext.Result = new RedirectToRouteResult(new System.Web.Routing.RouteValueDictionary(new { Area = "", Controller = "Error", action = "NoAccess", bAjaxReq = false, message = "没有获取到任何菜单，您没有权限访问当前内容：" + pageUrl + "。" })); } } else { // 获取到菜单，进行比较 //var controllerName = (filterContext.RouteData.Values["controller"]).ToString().ToLower(); //var actionName = (filterContext.RouteData.Values["action"]).ToString().ToLower(); //var areaName = (filterContext.RouteData.DataTokens["area"] ?? "").ToString().ToLower(); /* 这个方式需要在controller或action上人为添加一个Attribute，没有必要，直接可以取到当前的controller和actionName // 用于标记在授权期间需要CustomerResourceAttribute 的操作的特性 var attNames = filterContext.ActionDescriptor.GetCustomAttributes(typeof(CustomerResourceAttribute), true) as IEnumerable<CustomerResourceAttribute>; // 判断用户的权限菜单中的code是否与控制器上标示的资源的code一致 var joinResult = (from aclEntity in moduleList join attName in attNames on aclEntity.Code equals attName.ResourceName select attName).Any(); if (!joinResult) */ // 子系统菜单配置时，子系统的菜单code不能重复 // 同时支持通过访问地址，Code来判断 // 主要是要在全局过滤器里添加 filters.Add(new CheckPermissionFilter()); // 检查地址是否与当前Action的地址一致 var modules = from module in moduleList where string.Equals(module.NavigateUrl, pageUrl, StringComparison.OrdinalIgnoreCase) //|| string.Equals(module.Code, controllerName, StringComparison.OrdinalIgnoreCase) //|| string.Equals(module.Code, actionName, StringComparison.OrdinalIgnoreCase) select module; //string results = JsonHelper.SerializeObject(moduleList); if (!modules.Any()) { // 菜单没有配置或者没有权限 if (bAjax) { BusinessResultBase result = new BusinessResultBase(); result.Title = "没有访问权限"; result.Status = false; result.StatusCode = BusinessStatusCode.AccessDeny.ToString(); result.StatusMessage = "在您的权限中，您没有权限访问当前内容：" + pageUrl + "。"; var jsonResult = new JsonResult(); jsonResult.Data = result; jsonResult.JsonRequestBehavior = JsonRequestBehavior.AllowGet; filterContext.Result = jsonResult; } else { filterContext.Result = new RedirectToRouteResult(new System.Web.Routing.RouteValueDictionary(new { Area = "", Controller = "Error", action = "NoAccess", bAjaxReq = false, message = "在您的权限中，您没有权限访问当前内容：" + pageUrl + "。" })); } } else { return; } } } } } }}
放在全局过滤器中即可，实现全部Action的访问控制
public class FilterConfig { public static void RegisterGlobalFilters(GlobalFilterCollection filters) { // filters.Add(new HandleErrorAttribute()); filters.Add(new ElmahHandleErrorAttribute()); // 全局身份验证过滤器 更方便 filters.Add(new CheckPermissionFilter()); } }
继承权限的使用场景：
在某些情况下，只要具有其中一个Action的权限，那么跟他关联的Action权限可以不用配置，
如在查询场景中，配置了用户访问 Public ActionResult Index()主页面的权限，查询时请求的是 Public ActionResult List(......)
那么在List上加上标签
[CheckActionPermission("/XXXArea/XXXController/Index")]
Public ActionResult List(......)
这样就可以了，
CheckActionPermission里的参数是要继续的Action的菜单路径。
避免为List再配置菜单，授权。
另外象添加页面，保存的action Save可以不必配置菜单授权，只要在上面配置[CheckActionPermission("/XXXArea/XXXController/Add")]即可。既然能看到添加界面，那么保存操作就应该是允许的。
//-----------------------------------------------------------------------// <copyright file="CheckActionPermissionAttribute" company="STO, Ltd.">// Copyright (c) 2017 , All rights reserved.// </copyright>//-----------------------------------------------------------------------using System;using System.Linq;using System.Web.Mvc;namespace DotNet.MVCInfrastructure.Attributes{ using DotNet.MVCInfrastructure.Enumerations; using DotNet.MVCInfrastructure.Models; using DotNet.MVCInfrastructure.Common; using DotNet.Utilities; /// <summary> /// CheckActionPermissionAttribute /// 记权限拦截 /// /// 修改纪录 /// /// 2017-07-21 版本：1.0 SongBiao 创建文件。 /// /// <author> /// <name>SongBiao</name> /// <date>2017-07-21</date> /// </author> /// </summary> [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, AllowMultiple = false)] public class CheckActionPermissionAttribute : ActionFilterAttribute, IActionFilter { /// <summary> /// 检查的Module /// </summary> private string Module; /// <summary> /// 构造函数 module表示检查哪个菜单的权限即可 /// 如某些列表，只需要检查主页面的菜单权限即可 /// CheckActionPermission["/Headquarters/DaTouBiMain/Index"] /// </summary> /// <param name="module"></param> public CheckActionPermissionAttribute(string module) { Module = module; } FilterContextInfo fcinfo; /// <summary> /// 在执行操作方法之前由 ASP.NET MVC 框架调用。 /// </summary> /// <param name="filterContext"></param> public override void OnActionExecuting(ActionExecutingContext filterContext) { string pageUrl = filterContext.HttpContext.Request.Url == null ? "$$#$$" : filterContext.HttpContext.Request.Url.AbsolutePath; //OperateContext.GetThisPageUrl(false); var bAjax = filterContext.HttpContext.Request.IsAjaxRequest(); if (string.IsNullOrWhiteSpace(Module)) { if (bAjax) { BusinessResultBase result = new BusinessResultBase(); result.Title = "参数值不可以为空"; result.Status = false; result.StatusCode = BusinessStatusCode.AccessDeny.ToString(); result.StatusMessage = "CheckActionPermission参数值不可以为空。"; var jsonResult = new JsonResult(); jsonResult.Data = result; jsonResult.JsonRequestBehavior = JsonRequestBehavior.AllowGet; filterContext.Result = jsonResult; } else { filterContext.Result = new RedirectToRouteResult(new System.Web.Routing.RouteValueDictionary(new { Area = "", Controller = "Error", action = "NoAccess", bAjaxReq = false, message = "CheckActionPermission参数值不可以为空" })); } } else { if (OperateContext.Current.UserInfo == null) { if (bAjax) { BusinessResultBase result = new BusinessResultBase(); result.Title = "未登录或登录已超时"; result.Status = false; result.StatusCode = BusinessStatusCode.AccessDeny.ToString(); result.StatusMessage = "未登录或登录已超时，请重新登录系统。"; var jsonResult = new JsonResult(); jsonResult.Data = result; jsonResult.JsonRequestBehavior = JsonRequestBehavior.AllowGet; filterContext.Result = jsonResult; } else { filterContext.Result = new RedirectResult(BusinessSystemInfo.LoginUrl + "?returnUrl=" + pageUrl); } } else { fcinfo = new FilterContextInfo(filterContext); string areaName = fcinfo.AreaName; string controllerName = fcinfo.ControllerName; string actionName = fcinfo.ActionName; // 当前访问的 string currentModule = "/"; if (!string.IsNullOrWhiteSpace(areaName)) { currentModule = currentModule + areaName; } if (!string.IsNullOrWhiteSpace(controllerName)) { currentModule = currentModule + "/" + controllerName; } if (!string.IsNullOrWhiteSpace(actionName)) { currentModule = currentModule + "/" + actionName; } var moduleList = OperateContext.Current.UserPermission; // 比较Module在菜单中是否存在 如列表的权限只需要验证主界面的权限即可 var modules = from module in moduleList where !string.IsNullOrWhiteSpace(module.NavigateUrl) && string.Equals(module.NavigateUrl.Trim(), Module.Trim(), StringComparison.OrdinalIgnoreCase) //|| string.Equals(module.Code, controllerName, StringComparison.OrdinalIgnoreCase) //|| string.Equals(module.Code, actionName, StringComparison.OrdinalIgnoreCase) select module; //var modules = moduleList.Where(t => string.Equals(t.NavigateUrl, Module, StringComparison.OrdinalIgnoreCase)); if (modules == null || !modules.Any()) { // 菜单没有配置或者没有权限 if (bAjax) { BusinessResultBase result = new BusinessResultBase(); result.Title = "没有访问权限"; result.Status = false; result.StatusCode = BusinessStatusCode.AccessDeny.ToString(); result.StatusMessage = "在您的权限中，您没有权限访问当前内容：" + currentModule + "，需要授予用户对：" + Module + "的权限。"; var jsonResult = new JsonResult(); jsonResult.Data = result; jsonResult.JsonRequestBehavior = JsonRequestBehavior.AllowGet; filterContext.Result = jsonResult; } else { filterContext.Result = new RedirectToRouteResult(new System.Web.Routing.RouteValueDictionary(new { Area = "", Controller = "Error", action = "NoAccess", bAjaxReq = false, message = "在您的权限中，您没有权限访问当前内容：" + currentModule + "，需要授予用户对：" + Module + "的权限。" })); } } else { return; } } } } /// <summary> /// 在执行操作方法后由 ASP.NET MVC 框架调用。 /// </summary> /// <param name="filterContext"></param> public override void OnActionExecuted(ActionExecutedContext filterContext) { base.OnActionExecuted(filterContext); } /// <summary> /// OnResultExecuted 在执行操作结果后由 ASP.NET MVC 框架调用。 /// </summary> /// <param name="filterContext"></param> public override void OnResultExecuted(ResultExecutedContext filterContext) { base.OnResultExecuted(filterContext); } /// <summary> /// OnResultExecuting 在执行操作结果之前由 ASP.NET MVC 框架调用。 /// </summary> /// <param name="filterContext"></param> public override void OnResultExecuting(ResultExecutingContext filterContext) { base.OnResultExecuting(filterContext); } public class FilterContextInfo { public FilterContextInfo(ActionExecutingContext filterContext) { #region 获取链接中的字符 DomainName = filterContext.HttpContext.Request.Url.Authority; AreaName = (filterContext.RouteData.DataTokens["area"] ?? "").ToString(); ControllerName = filterContext.RouteData.Values["controller"].ToString(); ActionName = filterContext.RouteData.Values["action"].ToString(); #endregion } /// <summary> /// 获取域名 /// </summary> public string DomainName { get; set; } /// <summary> /// 获取 controllerName 名称 /// </summary> public string AreaName { get; set; } /// <summary> /// 获取 controllerName 名称 /// </summary> public string ControllerName { get; set; } /// <summary> /// 获取ACTION 名称 /// </summary> public string ActionName { get; set; } } }}
阅读全文
0 0
- asp.net mvc 全局权限过滤器及继成权限方法
- Asp.net MVC中的全局权限验证方法及实现
- MVC 全局菜单权限过滤器
- asp.net MVC 权限设计
- asp.net MVC 权限设计
- asp.net MVC 权限设计
- Asp.net MVC自定义权限
- asp.net MVC 权限设计
- ASP.NET MVC：窗体身份验证及角色权限管理示例
- ASP.NET MVC：窗体身份验证及角色权限管理示例
- ASP.NET MVC 窗体身份验证及角色权限管理示例
- ASP.NET MVC：窗体身份验证及角色权限管理示例
- ASP.NET MVC：窗体身份验证及角色权限管理示例
- ASP.NET MVC：窗体身份验证及角色权限管理示例 .
- ASP.NET MVC：窗体身份验证及角色权限管理示例
- ASP.NET MVC：窗体身份验证及角色权限管理示例
- ASP.NET MVC：窗体身份验证及角色权限管理示例
- asp.net mvc 控制器&动作方法 角色 权限验证
- PCLint与SourceInsight
- tensorflow学习——tfreader格式，队列读取数据tf.train.shuffle_batch()
- Incorrect string value: '\xE8\xB0\xA2\xE8\xB0\xA2...' for column 'words' at row 1
- hdu 3496 Watch The Movie（带限制的01背包）
- Ubuntu下配置超级终端minicom
- asp.net mvc 全局权限过滤器及继成权限方法
- PAT basic 1012
- uva 11728
- Ubuntu下 VirtualBox的安装和卸载
- VMWare 装mac os x 一个必备优化神器 beamoff
- PAT basic 1013
- 线程池的使用
- PAT basic 1014
- PAT basic 1014.2
