在我的Web应用程序中,注册用户可以添加新内容并在以后进行编辑.我只希望内容的作者能够编辑它.除了在检查记录的用户是否与作者相同的所有操作方法中手动编写代码之外,还有其他智能方法吗?我可以用于整个控制器的任何属性?
解决方法
Any attribute that I Could use for the whole controller?
public class AuthorizeAuthorAttribute : AuthorizeAttribute { protected override bool AuthorizeCore(HttpContextBase httpContext) { var isAuthorized = base.AuthorizeCore(httpContext); if (!isAuthorized) { // the user is either not authenticated or // not in roles => no need to continue any further return false; } // get the currently logged on user var username = httpContext.User.Identity.Name; // get the id of the article that he is trying to manipulate // from the route data (this assumes that the id is passed as a route // data parameter: /foo/edit/123). If this is not the case and you // are using query string parameters you Could fetch the id using the Request var id = httpContext.Request.RequestContext.RouteData.Values["id"] as string; // Now that we have the current user and the id of the article he // is trying to manipualte all that's left is go ahead and look in // our database to see if this user is the owner of the article return IsUserOwnerOfArticle(username,id); } private bool IsUserOwnerOfArticle(string username,string articleId) { throw new NotImplementedException(); } }
然后:
[HttpPost] [AuthorizeAuthor] public ActionResult Edit(int id) { ... perform the edit }
版权声明:本文内容由互联网用户自发贡献,该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容, 请发送邮件至 dio@foxmail.com 举报,一经查实,本站将立刻删除。