Question

我正在修改用c＃MVC编写的系统。

我刚刚在管理员区域中内置了一些额外的功能，允许管理员创建具有有限管理员功能的用户帐户。我已将以下内容放在每个控制器上以获得新功能：

[Authorize(Roles = "Administrator")]

但是，如果我使用有限的管理员帐户登录，并导航到此页面，它可以让我通过。

我很难过，因为我似乎是以正确的方式做这件事，但我对MVC也很新，还有什么我可以检查的吗？我没有更改web.config文件中的任何内容，所以应该没问题。

我知道上面的信息有限，没有寻找现成的解决方案，更多关于我可以检查以纠正问题的建议。

感谢

编辑：

这是新角色/帐户的创建方式。也很容易，这是第一次尝试，没有太多的验证。

[Authorize(Roles = "Administrator")]
    [HttpPost]
    public ActionResult AddSalesManager(App.Web.Areas.Administrator.Models.SalesManager model, FormCollection formValues)
    {
        if (formValues["Cancel"] != null)
        {
            return RedirectToAction("Index");
        }

        if (!string.Equals(model.password, model.confirmpassword))
        {
            ModelState.AddModelError("password", "Password and Confirmation must match");
        }

        if (ModelState.IsValid)
        {
            using (ModelContainer ctn = new ModelContainer())
            {
                // First, create the user account inside the ASP.Net membership system.
                //

                Membership.ApplicationName = "App";
                Roles.ApplicationName = "App";

                if (!Roles.RoleExists("LimitedAdmin"))
                    Roles.CreateRole("LimitedAdmin");

               // MembershipCreateStatus createStatus = MembershipService.CreateUser(model.email, model.password, model.email);
                if (Membership.GetUser(model.email) == null)
                {
                    Membership.CreateUser(model.email, model.password);
                    Roles.AddUserToRole(model.email, "LimitedAdmin");
                }

            }
        }
        return RedirectToAction("Index");

    }

Answer 1

角色属性

 [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, Inherited = true, AllowMultiple = false)]
public class PermissionsAttribute : ActionFilterAttribute
{
    private readonly PermissionsType required;

    public PermissionsAttribute()
    {
    }

    public PermissionsAttribute(PermissionsType required)
    {
        this.required = required;
    }

    public override void OnActionExecuting(ActionExecutingContext filterContext)
    {
        // Log("OnActionExecuting", filterContext.RouteData);

        HttpSessionStateBase session = filterContext.HttpContext.Session;
        Controller controller = filterContext.Controller as Controller;

        //This is uesd to  redirect to same controller but differnect action
        // controller.HttpContext.Response.Redirect("./Login");

        var rjasthan = filterContext;


        var URK = filterContext.HttpContext.Request.RawUrl;
        if (session["UserPermissions"] != null)
        {
            if (!CheckPermissions((UserPermission)session["UserPermissions"]))
            {
                // this is used to signout from sesssion
                //  filterContext.HttpContext.GetOwinContext().Authentication.SignOut();

                filterContext.Controller.TempData["AuthenticationMessages"] = "You are not authorized to access";

                filterContext.Result = new RedirectToRouteResult(new RouteValueDictionary{
                             { "controller", "Home" },{ "action", "UnAuthorizeAccess" }});

            }
        }

        base.OnActionExecuting(filterContext);

    }

    protected bool CheckPermissions(UserPermission model)
    {
        bool result = false;

        if (this.required == (PermissionsType.Add))
        {
            if (model.AddRight)
                result = true;
        }
        else if (this.required == (PermissionsType.View))
        {
            if (model.ViewRight)
                result = true;
        }
        else if (this.required == (PermissionsType.Edit))
        {
            if (model.EditRight)
                result = true;
        }
        else if (this.required == (PermissionsType.Delete))
        {
            if (model.DeleteRight)
                result = true;
        }
        else if (this.required == (PermissionsType.View | PermissionsType.Edit))
        {
            if (model.ViewRight && model.EditRight)
            {
                result = true;
            }
        }
        else if (this.required == (PermissionsType.Add | PermissionsType.Edit))
        {
            if (model.AddRight && model.EditRight)
            {
                result = true;
            }
        }


        return result;
    }

    private void Log(string methodName, RouteData routeData)
    {
        var controllerName = routeData.Values["controller"];
        var actionName = routeData.Values["action"];
        var message = String.Format("{0} controller:{1} action:{2}", methodName, controllerName, actionName);
        Debug.WriteLine(message, "Action Filter Log");
    }
}

[Flags]
public enum PermissionsType
{
    View = (1 << 0),
    Add = (1 << 1),
    Edit = (1 << 2),
    Delete = (1 << 3),
    Admin = (View | Add | Edit | Delete)
}



 [Permissions(PermissionsType.Add)]
    public ActionResult Register()
    {
        return this.AjaxableView();
    }

Answer 2

您对此代码有何期待？

使用此属性，您将获得管理员角色中的所有用户执行此控制器操作的权限，无论该帐户有多么有限。

授权属性不使用角色MVC C＃

2 个答案: