protected void Page_Load(object sender, EventArgs e)
{
try
{
SessionUtil.SavaModuleTag("ChangeMyPwd");
if (SessionUtil.GetStaffSession().IsInnerUser == 0)
{
PermissionUtil.SaveGrantPermissionsToSession();
if (!PermissionUtil.HasGrantPermission("rights_browse"))
{
throw new ModuleSecurityException("无权限访问此模块。");
}
}
}
catch (MissSessionException)
{
ClientScript.RegisterClientScriptBlock(this.GetType(), "reload",
"<script type=\"text/javascript\">parent.location='../../Default.aspx';</script>");
}
catch (ModuleSecurityException)
{
Response.Redirect("../../Frameset/Welcome.aspx");
}
catch (Exception ex)
{
log.Error(null, ex);
throw;
}
}
public override void OnActionExecuting(ActionExecutingContext filterContext)
{
//获取当前的Action
//后台添加模块的标示 需要跟 action 一致
string currentAction = filterContext.RouteData.Values["action"].ToString();
//var staff = Gecko.Security.Service.StaffSrv.GetStaffByLoginId(SessionUtil.GetStaffSession().LoginId);
////判断用户是否有 当前 action 浏览的权限 暂时不用缓存
//var m = Gecko.Security.Service.ModuleSrv.GetModuleByTag(currentAction);
//if (m != null)
//{
// var m_rights = staff.GetGrantPermissions(m);
// if (!m_rights.Contains("rights_browse"))
// {
// var contentResult = new ContentResult();
// contentResult.Content = "无权限访问";
// filterContext.Result = contentResult;
// }
//}
//配合 permissionUtil 进行访问
var isHave = PermissionUtil.HasGrantPermission("rights_browse");
//如果当前用户没有浏览权限
if (!isHave)
{
var contentResult = new ContentResult();
contentResult.Content = "无权限访问";
filterContext.Result = contentResult;
}
base.OnActionExecuting(filterContext);
}
protected void Page_Load(object sender, EventArgs e)
{
Response.Cache.SetCacheability(HttpCacheability.NoCache);
try
{
SessionUtil.SavaModuleTag("StaffMgr");
if (SessionUtil.GetStaffSession().IsInnerUser == 0)
{
PermissionUtil.SaveGrantPermissionsToSession();
if (!PermissionUtil.HasGrantPermission("rights_browse"))
{
throw new ModuleSecurityException("无权限访问此模块。");
}
if (!PermissionUtil.HasGrantPermission("rights_add"))
{
btnNew.Style.Add("display", "none");
}
if (!PermissionUtil.HasGrantPermission("rights_edit"))
{
btnEdit.Style.Add("display", "none");
btnEditPassword.Style.Add("display", "none");
}
if (!PermissionUtil.HasGrantPermission("rights_move"))
{
btnMove.Style.Add("display", "none");
}
if (!PermissionUtil.HasGrantPermission("rights_accredit"))
{
btnRole.Style.Add("display", "none");
btnPermission.Style.Add("display", "none");
}
if (!PermissionUtil.HasGrantPermission("rights_delete"))
{
btnDelete.Style.Add("display", "none");
}
}
LoadDepartmentTree(tvDepartments.Nodes[0], null);
}
catch (MissSessionException)
{
ClientScript.RegisterClientScriptBlock(this.GetType(), "reload",
"<script type=\"text/javascript\">parent.location='../../Default.aspx';</script>");
}
catch (ModuleSecurityException)
{
Response.Redirect("../../Frameset/Welcome.aspx");
}
catch (Exception ex)
{
log.Error(null, ex);
throw;
}
}
/// <summary>
/// 检查当前已登录职员是否对当前模块的某项权限有肯定的授权。
/// </summary>
/// <remarks>
/// 在模块的每一项操作（ashx）执行前被调用，用于确认职员的授权，防止用户对ashx的恶意调用。
/// </remarks>
/// <param name="moduleTag">模块标示。</param>
/// <param name="rightTag">权限标示。</param>
public static void CheckSecurity(string moduleTag, string rightTag)
{
if (!SessionUtil.CompareModuleTag(moduleTag))
{
throw new ModuleSecurityException("模块标示不匹配。");
}
if (!PermissionUtil.HasGrantPermission(rightTag))
{
throw new ModuleSecurityException("无权执行此项操作。");
}
}