淘淘商城08_許可權攔截器04
阿新 • • 發佈：2018-12-17
把使用者的許可權和選單存放到session中
SysPermissionUserMapper：
package com.taotao.mapper; import java.util.List; import com.taotao.pojo.SysPermission; public interface SysPermissionUserMapper { //根據使用者id查詢使用者選單 List<SysPermission> getMenuByUserId(String userId); //根據使用者id查詢使用者許可權 List<SysPermission> getPermissionUrlByUserId(String userId); }
SysPermissionUserMapper.xml
<?xml version="1.0" encoding="UTF-8" ?> <!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd" > <mapper namespace="com.taotao.mapper.SysPermissionUserMapper" > <!-- 查詢使用者選單 --> <select id="getMenuByUserID" parameterType="String" resultType="com.taotao.pojo.SysPermission"> SELECT * FROM sys_permission WHERE type = 'menu' AND id IN ( SELECT sys_permission_id FROM sys_role_permission WHERE sys_role_id IN ( SELECT sys_role_id FROM sys_user_role WHERE sys_user_id = #{userid} ) ) </select> <!-- 查詢使用者許可權URL --> <select id="getPermissionByUserID" parameterType="String" resultType="com.taotao.pojo.SysPermission"> SELECT * FROM sys_permission WHERE type = 'permission' AND id IN ( SELECT sys_permission_id FROM sys_role_permission WHERE sys_role_id IN ( SELECT sys_role_id FROM sys_user_role WHERE sys_user_id = #{userid} ) ) </select> </mapper>
SysPermissionService:
package com.taotao.service; import java.util.List; import com.taotao.pojo.SysPermission; import com.taotao.pojo.SysUser; import com.taotao.utils.TaotaoResult; /** * 使用者認證介面 * @author fengjinzhu * */ public interface SysPermissionService { //使用者認證 public TaotaoResult authenticat(String usercode, String password); //查詢使用者 public SysUser getSysUser(String usercode); //根據使用者id查詢使用者選單 List<SysPermission> getMenuByUserId(String userId); //根據使用者id查詢使用者許可權 List<SysPermission> getPermissionUrlByUserId(String userId); }
SysPermissionServiceImpl
package com.taotao.service;
import java.util.List;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;
import org.springframework.util.DigestUtils;
import com.taotao.mapper.SysPermissionUserMapper;
import com.taotao.mapper.SysUserMapper;
import com.taotao.pojo.ActiveUser;
import com.taotao.pojo.SysPermission;
import com.taotao.pojo.SysUser;
import com.taotao.utils.TaotaoResult;
@Service
public class SysPermissionServiceImpl implements SysPermissionService {
@Autowired
private SysUserMapper sysUserMapper;
@Autowired
private SysPermissionUserMapper sysPermissionUserMapper;
@Override
public TaotaoResult authenticat(String usercode, String password) {
//1.獲取該物件
SysUser sysUser = this.getSysUser(usercode);
//2.判斷該使用者 是否存在
if (sysUser == null) {
return TaotaoResult.build(400, "該使用者不存在！");
}
//判斷使用者的密碼
//從資料庫中取出該使用者的密碼，該密碼是經過Md5加密的
String pwd_db = sysUser.getPassword();
//1.獲取該使用者的鹽值
String salt = sysUser.getSalt();
//2.獲取前臺輸入的密碼password
//3.將鹽值和password相加後加密
String salt_pwd = salt+password;
//獲取到該使用者輸入的密碼，將輸入的密碼經過MD5加密
String pwd_input = DigestUtils.md5DigestAsHex(salt_pwd.getBytes());
//與資料庫中取出的密碼相比較
if (! pwd_db.equalsIgnoreCase(pwd_input)) {
return TaotaoResult.build(400, "使用者名稱或密碼錯誤！");
}
//將資料新增到activeUser類中
ActiveUser activeUser = new ActiveUser();
activeUser.setUsercode(usercode);
activeUser.setUsername(sysUser.getUsername());
activeUser.setUserid(sysUser.getId());
return TaotaoResult.ok(activeUser);
}
public SysUser getSysUser(String usercode){
SysUser sysUser = new SysUser();
sysUser.getUsercode();
List<SysUser> list = sysUserMapper.getSysUserByCode(usercode);
if (list !=null && list.size() >0) {
return list.get(0);
}
return null;
}
@Override
public List<SysPermission> getMenuByUserId(String userId) {
// TODO Auto-generated method stub
return sysPermissionUserMapper.getMenuByUserId(userId);
}
@Override
public List<SysPermission> getPermissionUrlByUserId(String userId) {
// TODO Auto-generated method stub
return sysPermissionUserMapper.getPermissionUrlByUserId(userId);
}
}
package com.taotao.service;
import java.util.List;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;
import org.springframework.util.DigestUtils;
import com.taotao.mapper.SysPermissionUserMapper;
import com.taotao.mapper.SysUserMapper;
import com.taotao.pojo.ActiveUser;
import com.taotao.pojo.SysPermission;
import com.taotao.pojo.SysUser;
import com.taotao.utils.TaotaoResult;
@Service
public class SysPermissionServiceImpl implements SysPermissionService {
@Autowired
private SysUserMapper sysUserMapper;
@Autowired
private SysPermissionUserMapper sysPermissionUserMapper;
@Override
public TaotaoResult authenticat(String usercode, String password) {
//1.獲取該物件
SysUser sysUser = this.getSysUser(usercode);
//2.判斷該使用者 是否存在
if (sysUser == null) {
return TaotaoResult.build(400, "該使用者不存在！");
}
//判斷使用者的密碼
//從資料庫中取出該使用者的密碼，該密碼是經過Md5加密的
String pwd_db = sysUser.getPassword();
//1.獲取該使用者的鹽值
String salt = sysUser.getSalt();
//2.獲取前臺輸入的密碼password
//3.將鹽值和password相加後加密
String salt_pwd = salt+password;
//獲取到該使用者輸入的密碼，將輸入的密碼經過MD5加密
String pwd_input = DigestUtils.md5DigestAsHex(salt_pwd.getBytes());
//與資料庫中取出的密碼相比較
if (! pwd_db.equalsIgnoreCase(pwd_input)) {
return TaotaoResult.build(400, "使用者名稱或密碼錯誤！");
}
String userId = sysUser.getId();
//將資料新增到activeUser類中
ActiveUser activeUser = new ActiveUser();
activeUser.setUsercode(usercode);
activeUser.setUsername(sysUser.getUsername());
activeUser.setUserid(sysUser.getId());
activeUser.setMenus(this.getMenuByUserId(userId));//許可權 選單
activeUser.setPermissions(this.getPermissionUrlByUserId(userId));//許可權url
return TaotaoResult.ok(activeUser);
}
public SysUser getSysUser(String usercode){
SysUser sysUser = new SysUser();
sysUser.getUsercode();
List<SysUser> list = sysUserMapper.getSysUserByCode(usercode);
if (list !=null && list.size() >0) {
return list.get(0);
}
return null;
}
@Override
public List<SysPermission> getMenuByUserId(String userId) {
// TODO Auto-generated method stub
return sysPermissionUserMapper.getMenuByUserId(userId);
}
@Override
public List<SysPermission> getPermissionUrlByUserId(String userId) {
// TODO Auto-generated method stub
return sysPermissionUserMapper.getPermissionUrlByUserId(userId);
}
}
PermissionInterceptor.java
package com.taotao.interceptor;
import java.util.List;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import org.springframework.web.servlet.HandlerInterceptor;
import org.springframework.web.servlet.ModelAndView;
import com.taotao.pojo.ActiveUser;
import com.taotao.pojo.SysPermission;
import com.taotao.utils.ResourcesUtil;
public class PermissionInterceptor implements HandlerInterceptor {
@Override
public void afterCompletion(HttpServletRequest arg0, HttpServletResponse arg1, Object arg2, Exception arg3)
throws Exception {
// TODO Auto-generated method stub
//執行後
}
@Override
public void postHandle(HttpServletRequest arg0, HttpServletResponse arg1, Object arg2, ModelAndView arg3)
throws Exception {
// TODO Auto-generated method stub
//執行前
}
@Override
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object arg2) throws Exception {
//1.獲取到請求的URL
String url = request.getRequestURI();
//2.判斷，公共的資源給放行，否則攔截
//用工具類ResourcesUtil.java讀取commonURL.properties，返回一個list集合,讀取commonURL.properties中的key值
List<String> opencomm_url = ResourcesUtil.gekeyList("commonURL");
for (String opencomm_urls : opencomm_url) {
if (url.indexOf(opencomm_urls)>=0) {
return true;
}
}
HttpSession session = request.getSession();//獲取到session
ActiveUser activeUser = (ActiveUser) session.getAttribute("activeUser");//獲取到session中儲存的activeUser
//從session中取出permission的url
//把url進行遍歷，放行
List<SysPermission> permissionList = activeUser.getPermissions();
for (SysPermission sysPermission : permissionList) {
//取出url欄位，只要資料庫中有的就放行
String openPermissionUrl = sysPermission.getUrl();
if (url.indexOf(openPermissionUrl)>=0) {
return true;
}
}
//跳轉頁面,不放行的就 無權訪問
request.getRequestDispatcher("/WEB-INF/jsp/refuse.jsp").forward(request, response);
return false;
}
}
commonURL.properties
#公開的url
/index=首頁springmvc.xml
<!-- 使用者許可權攔截 -->
<mvc:interceptor>
<mvc:mapping path="/**"/>
<mvc:exclude-mapping path="/**/fonts/*"/>
<mvc:exclude-mapping path="/**/*.css"/>
<mvc:exclude-mapping path="/**/*.js"/>
<mvc:exclude-mapping path="/**/*.png"/>
<mvc:exclude-mapping path="/**/*.gif"/>
<mvc:exclude-mapping path="/**/*.jpg"/>
<mvc:exclude-mapping path="/**/*.jpeg"/>
<mvc:exclude-mapping path="/**/*validatecode*"/>
<mvc:exclude-mapping path="/**/*Login*"/>
<mvc:exclude-mapping path="/**/*error*"/>
<bean class="com.taotao.interceptor.PermissionInterceptor"/>
</mvc:interceptor>