Question

我定义了一个自定义授权属性，它自动应用于解决方案中的所有操作。在它的OnAuthorize方法中，我使用IsDefined方法来查找是否定义了另一个属性，但它似乎总是返回false。

编辑：AuthorizeAttr属性在Global.asax的RegisterGlobalFilters函数中设置，Anon属性直接标记在不需要授权的操作上方。

这是我的代码：

[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, AllowMultiple = false, Inherited = true)]
public class Anon : Attribute { }

public class Role : Attribute
{
    public int Id;
    public Role(int id)
    {
        Id = id;
    }
}

public class AuthorizeAttr : AuthorizeAttribute
{
    public override void OnAuthorization(AuthorizationContext filterContext)
    {
        if (!(filterContext.ActionDescriptor.IsDefined(typeof(Anon), false)) || !(filterContext.ActionDescriptor.ControllerDescriptor.IsDefined(typeof(Anon), false)))
        {
            Procurement.User u = MvcApplication.GetCurrentUser(filterContext.HttpContext);
            if (u == null || !u.enabled)
                filterContext.Result = new RedirectResult("/Session/Login?msg=You must log in to use this site.&ReturnUrl=" + filterContext.RequestContext.HttpContext.Request.RawUrl);
            if (filterContext.ActionDescriptor.IsDefined(typeof(Role), false))
            {
                object[] criterias = filterContext.ActionDescriptor.GetCustomAttributes(typeof(Role), false);
                bool authorized = true;
                for (int x = 0; x < criterias.Length; x++)
                {
                    if (((Role)criterias[x]).Id > u.roleId)
                    {
                        authorized = false;
                        break;
                    }
                }

                if (!authorized)
                {
                    ContentResult C = new ContentResult();
                    C.Content = "<h1><b>The resource is unavailable!</b></h1>";
                    filterContext.Result = C;
                }
            }
        }

    }
}

Answer 1

在布尔代数中否定

isDefinedOnAction || isDefinedOnController

是：

!isDefinedOnAction && !isDefinedOnController

所以你可能想要一个&&条件：

public override void OnAuthorization(AuthorizationContext filterContext)
{
    var isDefinedOnAction = filterContext.ActionDescriptor.IsDefined(typeof(Anon), false);
    var isDefinedOnController = filterContext.ActionDescriptor.ControllerDescriptor.IsDefined(typeof(Anon), false);
    if (!isDefinedOnAction && !isDefinedOnController)
    {
        ... the Anon attribute is not present neither on an action nor on a controller
        => perform your authorization here
    }
}

或者如果你想要||：

public override void OnAuthorization(AuthorizationContext filterContext)
{
    var isDefinedOnAction = filterContext.ActionDescriptor.IsDefined(typeof(Anon), false);
    var isDefinedOnController = filterContext.ActionDescriptor.ControllerDescriptor.IsDefined(typeof(Anon), false);
    if (isDefinedOnAction || isDefinedOnController)
    { 
        ... the attribute is present on either a controller or an action
        => do nothing here
    }
    else
    {
        ... perform your authorization here
    }
}

显然，第一个是更具可读性。

MVC 3自定义授权属性isDefined始终返回true

1 个答案: