[英]struts2 check permission interceptor
In my current struts2 + spring web application, I have my custom userSessionInterceptor that works well. 在我当前的struts2 + spring Web应用程序中,我有自定义的userSessionInterceptor,它运行良好。 I now also want to start enforcing user roles as well. 我现在也想开始执行用户角色。 I have done many online researches, seems like there are many ways to do it, eg exceptions, sendRedirect 我已经做了很多在线研究,似乎有很多方法可以做到,例如,异常,sendRedirect
What is the most proper way to do this? 最合适的方法是什么? I already have the user role saved in the user session and I have no problem detecting and spotting out the error. 我已经在用户会话中保存了用户角色,并且检测并发现错误没有问题。 The only thing I need to decide is how to react to it when the permission is not right. 我唯一需要决定的是权限不正确时如何应对。
In the interceptator, I know i can return "xxx" and get to the "xxx" action. 在拦截器中,我知道我可以返回“ xxx”并执行“ xxx”操作。 However, what I want to achieve is that when the user tries to do something that they have no permission, a message will be displayed. 但是,我要实现的是,当用户尝试执行未经许可的操作时,将显示一条消息。 I assume I can return back to the previous page and add a parameter to the url. 我假设我可以返回上一页并将参数添加到url。
Any tips on this? 有什么提示吗?
Thanks 谢谢
Here is a sample program. 这是一个示例程序。
RoleInterceptor.java RoleInterceptor.java
package com.sample.common.interceptor;
import javax.servlet.http.HttpSession;
import org.apache.struts2.ServletActionContext;
import com.opensymphony.xwork2.ActionContext;
import com.opensymphony.xwork2.ActionInvocation;
import com.opensymphony.xwork2.interceptor.Interceptor;
import com.opensymphony.xwork2.util.ValueStack;
public class RoleInterceptor implements Interceptor {
private static final long serialVersionUID = 5031826078189685536L;
@Override
public void init() {
}
@Override
public void destroy() {
}
@Override
public String intercept(ActionInvocation actionInvocation) {
String result = null;
try {
ActionContext actionContext = actionInvocation
.getInvocationContext();
ValueStack vStack = actionContext.getValueStack();
HttpSession httpSession = ServletActionContext.getRequest()
.getSession();
StringBuilder actionUrl = new StringBuilder(actionInvocation
.getProxy().getNamespace());
actionUrl.append("/");
actionUrl.append(actionInvocation.getProxy().getActionName());
if (httpSession != null) {
boolean hasPermission = true; // if the role has the permission
if (hasPermission) {
result = actionInvocation.invoke();
} else {
vStack.set("userMsg",
"You are not authorized to access this link");
result = "user.unauthorized";
}
} else {
vStack.set("userMsg", "Please login to your account");
result = "user.login";
}
} catch (Exception e) {
e.printStackTrace();
}
return result;
}
}
struts.xml struts.xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE struts PUBLIC
"-//Apache Software Foundation//DTD Struts Configuration 2.0//EN"
"http://struts.apache.org/dtds/struts-2.0.dtd">
<struts>
<package name="userRoleInterceptor">
<interceptors>
<interceptor name="userRole"
class="com.sample.common.interceptor.RoleInterceptor" />
</interceptors>
</package>
<package name="user" namespace="/user" extends="struts-default, json-default, userRoleInterceptor">
<action name="user_details" method="getUserDetails"
class="com.sample.user.web.action.User">
<interceptor-ref name="userRole"/>
<interceptor-ref name="store">
<param name="operationMode">RETRIEVE</param>
</interceptor-ref>
<result name="success">userDetails.jsp</result>
<result name="input">/common/error.jsp</result>
<result name="busy" type="redirectAction" >/common/busy.jsp</result>
<result name="error" type="redirectAction" >/common/test.jsp</result>
<result name="user.login" type="redirectAction" >/common/login.jsp</result>
<result name="user.unauthorized" type="redirectAction" >/common/unauthorizedUser.jsp</result>
</action>
</package>
</struts>
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.