asp.net MVC 3将AuthorizeAttribute应用于区域
|
我目前正在编写一个Admin MVC 3网站，每个用户只能访问该网站的某些部分。
我网站的区域与用户角色相同，因此我想做的是将AuthorizeAttribute放在每个区域上，并使用区域名称作为Role中的参数。
到目前为止，当我对每个区域的检查进行硬编码时，我已经可以使用它了，但是我只想遍历所有区域并应用Authorize过滤器。
（我将其用作我的自定义FilterProvider-http://www.dotnetcurry.com/ShowArticle.aspx?ID=578）
到目前为止，我的代码（\“ Gcm \”是我的领域之一，也是一个角色）：
public static void RegisterGlobalFilters(GlobalFilterCollection filters)
{
filters.Add(new HandleErrorAttribute());
// for all controllers, run AdminAuthorizeAttribute to make sure they\'re at least logged in
filters.Add(ObjectFactory.GetInstance<AdminAuthorizeAttribute>());
AdminAuthorizeAttribute gcmAuthroizeAttribute = ObjectFactory.GetInstance<AdminAuthorizeAttribute>();
gcmAuthroizeAttribute.Roles = \"Gcm\";
var provider = new FilterProvider();
provider.Add(
x =>
x.RouteData.DataTokens[\"area\"] != null && x.RouteData.DataTokens[\"area\"].ToString() == \"Gcm\"
? gcmAuthroizeAttribute
: null);
FilterProviders.Providers.Add(provider);
}
没有找到相关结果
已邀请:
3 个回复
醒荒捆府绣
良阑纠苫
码：public class AjaxAuthorizeAttribute : AuthorizeAttribute { private class HttpAuthorizeFailedResult : ActionResult { public override void ExecuteResult(ControllerContext context) { // Set the response code to 403. Membership.Provider.Name == \"UnitArchiveMembershipProvider\" context.HttpContext.Response.StatusCode = context.HttpContext. User.Identity is WindowsIdentity ? 401 : 403; } } public string AjaxRole { get; set;} public AjaxAuthorizeAttribute() { AjaxRole = \"Users\"; } protected override bool AuthorizeCore(HttpContextBase httpContext) { if (string.IsNullOrEmpty(MvcApplication.Config.DBSettings.Database)) { return true; } //When authorize parameter is set to false, not authorization should be performed. UnitArchiveData db = DataContextFactory.GetWebRequestScopedDataContext<UnitArchiveData>(MvcApplication.Config.DBSettings.GetConnectionString()); if (httpContext.User.Identity.IsAuthenticated) { login_data user = db.login_datas.Where(n => n.EmailAddress == httpContext.User.Identity.Name).FirstOrDefault(); if (user != null) { return user.cd_login_role.RoleName == \"Administrators\" || user.cd_login_role.RoleName == AjaxRole; } } return false; } protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext) { if (filterContext.RequestContext.HttpContext.Request.IsAjaxRequest()) { //Ajax request doesn\'t return to login page, it just returns 403 error. filterContext.Result = new HttpAuthorizeFailedResult(); } else base.HandleUnauthorizedRequest(filterContext); } }拟僚疽刊剔
public class CustomAuthorizeAttribute : AuthorizeAttribute { public override void OnAuthorization(AuthorizationContext filterContext) { RouteData routeData = filterContext.RouteData; // check if user is allowed on this page if (SessionFactory.GetSession().Contains(SessionKey.User)) { User user = (User)SessionFactory.GetSession().Get(SessionKey.User); string thisArea = routeData.DataTokens[\"area\"].ToString(); // if the user doesn\'t have access to this area if (!user.IsInRole(thisArea)) { HandleUnauthorizedRequest(filterContext); } } // do normal OnAuthorization checks too base.OnAuthorization(filterContext); } }public static void RegisterGlobalFilters(GlobalFilterCollection filters) { filters.Add(new HandleErrorAttribute()); // for all controllers, run CustomAuthorizeAttribute to make sure they\'re at logged in and have access to area filters.Add(ObjectFactory.GetInstance<CustomAuthorizeAttribute>()); }