按查询结果阻止访问

Question

I have Hospitals and Medical Specialities.

My Medical Specialities page return data by hospital ID in this way:

localhost/MedicalSpecialities/1, 1 is the HospitalID. if I change manually the link I can access any hospital info.

I have users associated to hospitals in this way:

I need to query the Hospital ID's that user have associated AND check if the current HospitalID is on the list.

This return all hospitals that user have connected:

        var userID = User.Identity.GetUserId();
        var result = db.Hospitals.Include("UserHospitals")
                              .Where(x => x.UserHospitals
                              .Any(u => u.Id == userID))
                              .ToList();

Answer 1

You can basically update the condition in your Any() method to include a check against the HospitalId column.

var hospitalId =5;
var result = db.Hospitals
               .Include(y=>y.UserHospitals)
               .Where(x => x.UserHospitals.Any(u => u.Id == userID 
                                                 && u.HospitalID==hospitalId ))
               .ToList();

If you are expecting only a single hospital for this condition, you may also consider using FirstOrDefault() method.

var singleHospital = db.Hospitals
                       .Include(y=>y.UserHospitals)
                       .Where(x => x.UserHospitals.Any(u => u.Id == userID 
                                                         && u.HospitalID==hospitalId ))
                       .FirstOrDefault();
if(singleHospital!=null)
{
     //Safely use it.
}