ASP.NET MVC4.0+EF+LINQ+bui+網站+角色權限管理系統（7）

今天將使用Simplemembership進行權限控制

我們使用mvc的AuthorizeAttribute來實現對Controller and Action權限控制

看如下標為紅色的代碼片段：

 /// <summary>
        /// 刪除數據操作
        /// </summary>
        /// <param name="id"></param>
        /// <returns></returns>
         [MVCSystemAuthorizeAttribute(permission = "刪除")]
        [HttpPost]
        public JsonResult ArticlesDelete(int id)
        {
            if (id > 0)
            {
                var aList = db.DB_Articles.Find(id);
                db.DB_Articles.Remove(aList);
                db.SaveChanges();
                return Json(1, JsonRequestBehavior.AllowGet);
            }
            else
            {
                return Json(0, JsonRequestBehavior.AllowGet);
            }
        }
        /// <summary>
        /// 添加修改
        /// </summary>
        /// <param name="id"></param>
        /// <returns></returns>
        [MVCSystemAuthorizeAttribute(permission = "添加")] public ActionResult ArticleAddEdit(int id)
        {
            ViewBag.Type = db.DB_ArticleTypes.ToList();
            ViewBag.Member = db.DB_Members.ToList();
            if (id == 0)
            {

                var aList = new M_Articles();
                return View(aList);
            }
            else {
                var aList = db.DB_Articles.Find(id);
                return View(aList);
            }
        }

從之前生成的表可以看出，Permission表存儲各個Action的名字（例如一個一個controller中的曾刪改查各個Action），PermissionsInRoles表就是存儲權限和角色關系。

然后我們在Filters/InitializeSimpleMembershipAttribute.cs中建立一個自己的MVCSystemAuthorizeAttribute繼承AuthorizeAttribute，並重寫AuthorizeCore和HandleUnauthorizedRequest方法。

using System;
using System.Data.Entity;
using System.Data.Entity.Infrastructure;
using System.Threading;
using System.Web.Mvc;
using WebMatrix.WebData;
using MVCSystem.Web.Models;
using MVCSystem.Web.Common;
using System.Web;

namespace MVCSystem.Web.Filters
{
    [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, AllowMultiple = false, Inherited = true)]
    public sealed class InitializeSimpleMembershipAttribute : ActionFilterAttribute
    {
        private static SimpleMembershipInitializer _initializer;
        private static object _initializerLock = new object();
        private static bool _isInitialized;

        public override void OnActionExecuting(ActionExecutingContext filterContext)
        {
            // 確保每次啟動應用程序時只初始化一次 ASP.NET Simple Membership
            LazyInitializer.EnsureInitialized(ref _initializer, ref _isInitialized, ref _initializerLock);
        }

        private class SimpleMembershipInitializer
        {
            public SimpleMembershipInitializer()
            {
                Database.SetInitializer<MVCSystemContext>(null);

                try
                {
                    using (var context = new MVCSystemContext())
                    {
                        if (!context.Database.Exists())
                        {
                            // 創建不包含 Entity Framework 遷移架構的 SimpleMembership 數據庫
                           // ((IObjectContextAdapter)context).ObjectContext.CreateDatabase();
                        }
                    }

                    WebSecurity.InitializeDatabaseConnection("DefaultConnection", "UserProfile", "UserId", "UserName", autoCreateTables: true);
                }
                catch (Exception ex)
                {
                    throw new InvalidOperationException("無法初始化 ASP.NET Simple Membership 數據庫。有關詳細信息，請參閱 http://go.microsoft.com/fwlink/?LinkId=256588", ex);
                }
            }
        }
    }
    [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, AllowMultiple = false, Inherited = true)]
    public class MVCSystemAuthorizeAttribute : AuthorizeAttribute
    {
        private bool _authorize;

        private bool _isPermissionFail = false;

        public string permission { get; set; }

        public MVCSystemAuthorizeAttribute()
        {
            if (HttpContext.Current.User.Identity.Name != "")
            {
                _authorize = true;
            }
            else
            {
                _authorize = false;
            }
        }

        public MVCSystemAuthorizeAttribute(string permission)
        {
            if (HttpContext.Current.User.Identity.Name != "")
            {
                _authorize = PermissionManager.CheckUserHasPermision(HttpContext.Current.User.Identity.Name, permission);
                if (_authorize == false)
                {
                    _isPermissionFail = true;
                }
            }
            else
            {
                _authorize = false;
            }
            //_authorize = true;
        }

        protected override bool AuthorizeCore(HttpContextBase httpContext)
        {
            if (httpContext == null)
            {
                throw new ArgumentNullException("HttpContext");
            }
            if (!httpContext.User.Identity.IsAuthenticated)
            {
                return false;
            }
            else
            {
                _authorize = PermissionManager.CheckUserHasPermision(HttpContext.Current.User.Identity.Name, permission);
                if (_authorize == false)
                {
                    _isPermissionFail = true;
                    return false;
                }
                return true;
            }
            // return false;
        }
        //protected override bool AuthorizeCore(HttpContextBase httpContext)
        //{
        //    return _authorize;
        //}

        public override void OnAuthorization(AuthorizationContext filterContext)
        {
            base.OnAuthorization(filterContext);
        }
        protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
        {
            if (_isPermissionFail)
            {
                filterContext.HttpContext.Response.Redirect("/Admin/Error/ErrorNoper");
            }
            else
            {
                base.HandleUnauthorizedRequest(filterContext);
            }

        }
    }
}

MVCSystemAuthorizeAttribute(string permission)接受一個permission字符串，這個就是Permission表中的數據，對應的每個Action【增刪查改】等名稱。

在這個構造參數里判斷當前用戶是否具有permission這個權限。PermissionManager.CheckUserHasPermision(HttpContext.Current.User.Identity.Name, permission)，如果有賦值true給_authorize，表示當前用戶有權限訪問這個Action。如果沒有賦值false給_authorize。

然后我們在common中創建一個類PermissionManager.cs，用來獲取登錄用戶的角色權限：

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.Security;
using MVCSystem.Web.Models;

namespace MVCSystem.Web.Common
{
    public class PermissionManager
    {
        public static bool CheckUserHasPermision(string userName, string permissionName)
        {
           
            using (MVCSystemContext db = new MVCSystemContext())
            {
               
                var userId = db.DB_UserProfiles.Single(u => u.UserName == userName).UserId;
                var roleIdList =db.DB_UsersInRoles.Where(k=>k.UserId==userId).ToList();
                foreach (var roles in roleIdList)
                {
                    var permissionList = (from m in db.DB_PermissionsInRoles
                                          where m.RoleId == roles.RoleId
                                          join n in db.DB_Permission
                                              on m.PermissionId equals n.PermissionId into pp
                                          from p in pp.DefaultIfEmpty()
                                          select new
                                          {
                                              PermissionName = (p.PermissionName == null) ? "" : p.PermissionName
                                          }).ToList();

                    foreach (var permission in permissionList)
                    {
                        if (permission.PermissionName == permissionName)
                        {
                            return true;
                        }
                    }
            }
            }

            return false;
        }
    }
}

這里需要注意的是var roleIdList =db.DB_UsersInRoles.Where(k=>k.UserId==userId).ToList();這句話，ToList()去掉之后會出現數據庫已經打開，這里不能打開的錯誤【已有打開的與此 Command 相關聯的 DataReader，必須首先將它關閉】！

然后，我設置當前我登錄的賬戶角色，這里我選擇“一般管理員”，而這個角色只有查看數據列表的權限，沒有增刪改的權限，運行結果如下：

到了這一步，后台搭建的功能基本完成了，接下里主要是完善前台網站的頁面，只要有一個漂亮的前端界面，那么接下來的代碼工作將會是最簡單的了。

源碼下載：http://www.yealuo.com/Sccnn/Detail?KeyValue=2f926407-f80b-4bff-a729-949a53efed7b

作者：boyzi007

出處：http://www.cnblogs.com/boyzi/

QQ：470797533

QQ交流群：364307742
本文版權歸作者和博客園共有，歡迎轉載，但未經作者同意必須保留此段聲明，且在文章頁面明顯位置給出原文連接，否則保留追究法律責任的權利。