在ASP.NET MVC中使用filter做权限

roydux,2010年1月25日

ASP.NET MVC中有一个基础的过滤器基类：FilterAttribute
和几个接口：
IActionFilter
IAuthorizationFilter
IExceptionFilter
IResultFilter

实现IAuthorizationFilter可以做权限限制：

public class AuthorAttribute : FilterAttribute,IAuthorizationFilter
    {
        #region IAuthorizationFilter 成员

        public void OnAuthorization(AuthorizationContext filterContext)
        {
            string controller = filterContext.ActionDescriptor.ControllerDescriptor.ControllerName.ToLower();
            string action = filterContext.ActionDescriptor.ActionName.ToLower();

            ModelEntites me = new ModelEntites();

            AuthorInfo author = me.AuthorInfo.First(a => a.Controller == controller && a.Action == action);
            UserInfo userInfo = me.UserInfo.FirstOrDefault(u => u.UserID == 1);
            if (userInfo == null)
            {
                Do(filterContext);
                return;
            }

            userInfo.RoleInfoReference.Load();
            RoleAuthorInfo raInfo = me.RoleAuthorInfo.First(ra => ra.AuthorInfo.AuthorID == author.AuthorID && ra.RoleInfo.RoleID == userInfo.RoleInfo.RoleID);
            if(raInfo == null)
            {
                Do(filterContext);
            }
        }


        private void Do(AuthorizationContext filterContext)
        {
            string controller = filterContext.ActionDescriptor.ControllerDescriptor.ControllerName.ToLower();
            string action = filterContext.ActionDescriptor.ActionName.ToLower();

            filterContext.Controller.TempData["msg"] = "木有权限";
            filterContext.Controller.TempData["url"] = "";
            filterContext.Controller.TempData["from_controller"] = controller;
            filterContext.Controller.TempData["from_action"] = action;

            filterContext.HttpContext.Response.Redirect(filterContext.HttpContext.Request.ApplicationPath + string.Format("Home/Index/"));
        }

        #endregion
    }


在要限制的Controller上加声明即可：
[AuthorAttribute]
    public class HelloController : Controller

访问该controller中的action，会被限制，也可以加到action前面。

public class AuthorAttribute : FilterAttribute,IAuthorizationFilter<br/> {<br/> #region IAuthorizationFilter 成员<br/><br/> public void OnAuthorization(AuthorizationContext filterContext)<br/> {<br/> string controller = filterContext.ActionDescriptor.ControllerDescriptor.ControllerName.ToLower();<br/> string action = filterContext.ActionDescriptor.ActionName.ToLower();<br/><br/> ModelEntites me = new ModelEntites();<br/><br/> AuthorInfo author = me.AuthorInfo.First(a => a.Controller == controller && a.Action == action);<br/> UserInfo userInfo = me.UserInfo.FirstOrDefault(u => u.UserID == 1);<br/> if (userInfo == null)<br/> {<br/> Do(filterContext);<br/> return;<br/> }<br/><br/> userInfo.RoleInfoReference.Load();<br/> RoleAuthorInfo raInfo = me.RoleAuthorInfo.First(ra => ra.AuthorInfo.AuthorID == author.AuthorID && ra.RoleInfo.RoleID == userInfo.RoleInfo.RoleID);<br/> if(raInfo == null)<br/> {<br/> Do(filterContext);<br/> }<br/> }<br/><br/><br/> private void Do(AuthorizationContext filterContext)<br/> {<br/> string controller = filterContext.ActionDescriptor.ControllerDescriptor.ControllerName.ToLower();<br/> string action = filterContext.ActionDescriptor.ActionName.ToLower();<br/><br/> filterContext.Controller.TempData["msg"] = "木有权限";<br/> filterContext.Controller.TempData["url"] = "";<br/> filterContext.Controller.TempData["from_controller"] = controller;<br/> filterContext.Controller.TempData["from_action"] = action;<br/><br/> filterContext.HttpContext.Response.Redirect(filterContext.HttpContext.Request.ApplicationPath + string.Format("Home/Index/"));<br/> }<br/><br/> #endregion<br/> }<br/><br/><br/>在要限制的Controller上加声明即可：<br/>[AuthorAttribute]<br/> public class HelloController : Controller<br/><br/>访问该controller中的action，会被限制，也可以加到action前面。<br/>

Tags: asp.net mvc  filter  

分类: .NET | 评论:1 | 浏览: