4.4 权限属性RequireAuthorizationAttribute

[csharp] view plaincopy
 
  1. "font-size:14px;">///
  2. /// 权限验证属性类
  3. ///
  4. public class RequireAuthorizeAttribute : AuthorizeAttribute
  5. {
  6. ///
  7. /// 用户权限列表
  8. ///
  9. public UserAuthModel[] UserAuthList
  10. {
  11. get
  12. {
  13. return AuthorizedUser.Current.UserAuthList;
  14. }
  15. }
  16. ///
  17. /// 登录用户票据
  18. ///
  19. public string UserLoginTicket
  20. {
  21. get
  22. {
  23. return AuthorizedUser.Current.UserLoginTicket;
  24. }
  25. }
  26. public override void OnAuthorization(AuthorizationContext filterContext)
  27. {
  28. base.OnAuthorization(filterContext);
  29. ////验证是否是登录用户
  30. var identity = filterContext.HttpContext.User.Identity;
  31. if (identity.IsAuthenticated)
  32. {
  33. var actionName = filterContext.ActionDescriptor.ActionName;
  34. var controllerName = filterContext.ActionDescriptor.ControllerDescriptor.ControllerName;
  35. //验证用户操作是否在权限列表中
  36. if (HasActionQulification(actionName, controllerName, identity.Name))
  37. if (!string.IsNullOrEmpty(UserLoginTicket))
  38. //有效登录用户，有权限访问此Action，则写入Cookie信息
  39. filterContext.HttpContext.Response.Cookies[FormsAuthentication.FormsCookieName].Value = UserLoginTicket;
  40. else
  41. //用户的Session, Cookie都过期，需要重新登录
  42. filterContext.HttpContext.Response.Redirect("~/Account/Login", false);
  43. else
  44. //虽然是登录用户，但没有该Action的权限，跳转到“未授权访问”页面
  45. filterContext.HttpContext.Response.Redirect("~/Home/UnAuthorized", true);
  46. }
  47. else
  48. {
  49. //未登录用户，则判断是否是匿名访问
  50. var attr = filterContext.ActionDescriptor.GetCustomAttributes(true).OfType();
  51. bool isAnonymous = attr.Any(a => a is AllowAnonymousAttribute);
  52. if (!isAnonymous)
  53. //未验证（登录）的用户, 而且是非匿名访问，则转向登录页面
  54. filterContext.HttpContext.Response.Redirect("~/Account/Login", true);
  55. }
  56. }
  57. ///
  58. /// 从权限列表验证用户是否有权访问Action
  59. ///
  60. ///
  61. ///
  62. ///
  63. private bool HasActionQulification(string actionName, string controllerName, stringuserName)
  64. {
  65. //从该用户的权限数据列表中查找是否有当前Controller和Action的item
  66. var auth = UserAuthList.FirstOrDefault(a =>
  67. {
  68. bool rightAction = false;
  69. bool rightController = a.Controller == controllerName;
  70. if (rightController)
  71. {
  72. string[] actions = a.Actions.Split(',');
  73. rightAction = actions.Contains(actionName);
  74. }
  75. return rightAction;
  76. });
  77. //此处可以校验用户的其它权限条件
  78. //var notAllowed = HasOtherLimition(userName);
  79. //var result = (auth != null) && notAllowed;
  80. //return result;
  81. return (auth != null);
  82. }
  83. }

 

4.5 业务Controller示例

[csharp] view plaincopy
 
    1. "font-size:14px;">public class ProductController : WebControllerBase
    2. {
    3. [AllowAnonymous]
    4. public ActionResult Query()
    5. {
    6. return View("ProductQuery");
    7. }
    8. [HttpGet]
    9. //[AllowAnonymous]
    10. [RequireAuthorize]
    11. public ActionResult Detail(string id)
    12. {
    13. var cookie = HttpContext.Request.Cookies;
    14. string url = base.ApiUrl + "/Get/" + id;
    15. HttpClient httpClient = HttpClientHelper.Create(url, base.UserLoginTicket);
    16. string result = httpClient.GetString();
    17. var model = JsonSerializer.DeserializeFromString(result);
    18. ViewData["PRODUCT_ADD_OR_EDIT"] = "E";
    19. return View("ProductForm", model);
    20. }
    21. }