一、登录把权限存在session中

1. rbac models

from django.db import models

class Permission(models.Model):

    """

    权限表

    """

    title = models.CharField(verbose_name='标题', max_length=32)

    url = models.CharField(verbose_name='含正则的URL', max_length=128)

    def __str__(self):

        return self.title

class Role(models.Model):

    """

    角色

    """

    title = models.CharField(verbose_name='角色名称', max_length=32)

    permissions = models.ManyToManyField(verbose_name='拥有的所有权限', to='Permission', blank=True)

    def __str__(self):

        return self.title

class UserInfo(models.Model):

    """

    用户表

    """

    name = models.CharField(verbose_name='用户名', max_length=32)

    password = models.CharField(verbose_name='密码', max_length=64)

    email = models.CharField(verbose_name='邮箱', max_length=32)

    roles = models.ManyToManyField(verbose_name='拥有的所有角色', to='Role', blank=True)

    def __str__(self):

        return self.name

2. web models

from django.db import models

class Customer(models.Model):

    """

    客户表

    """

    name = models.CharField(verbose_name='姓名', max_length=)

    age = models.CharField(verbose_name='年龄', max_length=)

    email = models.EmailField(verbose_name='邮箱', max_length=)

    company = models.CharField(verbose_name='公司', max_length=)

    def __str__(self):

        return self.name

    class Meta:

        verbose_name_plural = "客户表"

class Payment(models.Model):

    """

    付费记录

    """

    customer = models.ForeignKey(verbose_name='关联客户', to='Customer')

    money = models.IntegerField(verbose_name='付费金额')

    create_time = models.DateTimeField(verbose_name='付费时间', auto_now_add=True)

    class Meta:

        verbose_name_plural = "支付表"

#########权限相关###########

PERMISSION_SESSION_KEY ="permission_list"

VALID_URL=[

    "^/login/$",

    "^/admin/.*",

]

from django.conf.urls import url

from web.views import customer

from web.views import payment

from web.views import login

urlpatterns = [

    url(r'^customer/list/$', customer.customer_list),

    url(r'^customer/add/$', customer.customer_add),

    url(r'^customer/edit/(?P<cid>\d+)/$', customer.customer_edit),

    url(r'^customer/del/(?P<cid>\d+)/$', customer.customer_del),

    url(r'^customer/import/$', customer.customer_import),

    url(r'^customer/tpl/$', customer.customer_tpl),

    url(r'^payment/list/$', payment.payment_list),

    url(r'^payment/add/$', payment.payment_add),

    url(r'^payment/edit/(?P<pid>\d+)/$', payment.payment_edit),

    url(r'^payment/del/(?P<pid>\d+)/$', payment.payment_del),

    url(r"^login/",login.login)

]

from  django.shortcuts import render,redirect

from rbac import models

# from luffy_permission.settings import PERMISSION_SESSION_KEY

from django.conf import settings

def login(request):

    if request.method == "GET":

        return render(request, 'login.html')

    #. 获取提交的用户名和密码

    user = request.POST.get("user")

    user = request.POST.get('user')

    pwd = request.POST.get("pwd")

    pwd = request.POST.get('pwd')

    #.检验用户是否合法

    obj = models.UserInfo.objects.filter(name=user, password=pwd).first()

    print(obj)

    if not obj:

        return render(request, 'login.html', {'msg': '用户名或密码错误'})

    #3获取用户信息和权限信息写入session

    permission_list =obj.roles.filter(permissions__url__isnull = False).values('permissions__url').distinct()

    print(permission_list)

    for item  in permission_list:

        print(item)

    request.session['user_info'] = {'id':obj.id,'name':obj.name}

    request.session[settings.PERMISSION_SESSION_KEY] = list(permission_list)

    return redirect('/customer/list/')

二、中间件

https://www.cnblogs.com/yuanchenqi/articles/9036467.html?tdsourcetag=s_pcqq_aiomsg (session知识点）

from django.utils.deprecation import MiddlewareMixin

from django.shortcuts import redirect,HttpResponse

from luffy_permission import settings

import re

class RbacMiddleware(MiddlewareMixin):

    #权限控制的中间件

    def process_request(self,request):

        #权限控制

        #1. 获取当前请求url

        current_url =request.path_info

        #1.5 白名单处理

        for reg in settings.VALID_URL:

            import re

            if re.match(reg,current_url):

                return None

        #2. 获取当前用户session所有权限

        permission_list =request.session.get(settings.PERMISSION_SESSION_KEY)

        if not permission_list:

            return redirect("/login")

        #3.进行权限校验

        print(current_url)

        print(permission_list)

        flag =False

        for item in permission_list:

            reg ="^%s$" %         item.get("permissions__url")

            import re

            if re.match(reg,current_url):

                flag=  True

                break

        if not flag:

            return HttpResponse("无权访问")

三、为客户添加菜单（二级菜单，一级菜单）

修改 models

class Permission(models.Model):

    """

    权限表

    """

    title = models.CharField(verbose_name='标题', max_length=)

    url = models.CharField(verbose_name='含正则的URL', max_length=)



    is_menu =models.BooleanField(verbose_name="是否可以作为菜单",default=False)

    icon =models.CharField(max_length=32,null=True,blank=True)
　　 红色即为增加字段

略

四、生成组件.

1.设置一个初始化组件，将登陆后的权限信息和菜单信息放入session

from django.conf import settings

def init_permission(request,user):

    """

    权限和菜单信息初始化，以后使用时，需要在登陆成功后调用该方法将权限和菜单信息放入session

    :param request:

    :param user:

    :return:

    """

    # . 获取用户信息和权限信息写入session

    permission_queryset = user.roles.filter(permissions__url__isnull=False).values('permissions__url',

                                                                                  'permissions__is_menu',

                                                                                  'permissions__title',

                                                                                  'permissions__icon',

                                                                                  ).distinct()

    menu_list = []

    permission_list = []

    for row in permission_queryset:

        permission_list.append({'permissions__url': row['permissions__url']})

        if row['permissions__is_menu']:

            menu_list.append(

                {'title': row['permissions__title'], 'icon': row['permissions__icon'], 'url': row['permissions__url']})

    request.session[settings.PERMISSION_SESSION_KEY] = permission_list

    request.session[settings.MENU_SESSION_KEY] = menu_list

2.登陆界面，留意红色字体，在调用权限组件

from django.shortcuts import render, redirect,HttpResponse

from rbac import models

from rbac.service.init_permission import init_permission

from django.conf import settings

def login(request):

    """

    用户登陆

    :param request:

    :return:

    """

    if request.method == 'GET':

        return render(request,'login.html')

    # . 获取提交的用户名和密码

    user = request.POST.get('user')

    pwd = request.POST.get('pwd')

    # . 检验用户是否合法

    obj = models.UserInfo.objects.filter(name=user,password=pwd).first()

    if not obj:

        return render(request, 'login.html',{'msg':'用户名或密码错误'})

    request.session['user_info'] = {'id': obj.id, 'name': obj.name}

   init_permission(request,obj)

    return redirect('/student/')

def student(request):

    return render(request,'student.html')

def student_add(request):

    return render(request, 'student_add.html')

3.中间件组件的整合

from django.utils.deprecation import MiddlewareMixin

from django.conf import settings

from django.shortcuts import redirect,HttpResponse

import re

class RbacMiddleware(MiddlewareMixin):

    """

    权限控制的中间件

    """

    def process_request(self, request):

        """

        权限控制

        :param request:

        :return:

        """

        # . 获取当前请求URL

        current_url = request.path_info

        # 1.5 白名单处理

        for reg in settings.VALID_URL:

            if re.match(reg,current_url):

                return None

        # . 获取当前用户session中所有的权限

        permission_list = request.session.get(settings.PERMISSION_SESSION_KEY)

        if not permission_list:

            return redirect('/login/')

        # . 进行权限校验

        flag = False

        for item in permission_list:

            reg = "^%s$" % item.get('permissions__url')

            if re.match(reg, current_url):

                flag = True

                break

        if not flag:

            return HttpResponse('无权访问')

巴特西

s11 day106-107 RBAC模块

一、登录把权限存在session中

二、中间件

四、生成组件.

1.设置一个初始化组件，将登陆后的权限信息和菜单信息放入session

2.登陆界面，留意红色字体，在调用权限组件

最新文章

热门文章

巴特西

s11 day106-107 RBAC模块

一、登录 把权限存在session中

二、中间件

四、生成组件.

1.设置一个初始化组件 ，将登陆后的权限信息和菜单信息放入session

2.登陆界面 ，留意红色字体，在调用权限组件

最新文章

热门文章

一、登录把权限存在session中

1.设置一个初始化组件，将登陆后的权限信息和菜单信息放入session

2.登陆界面，留意红色字体，在调用权限组件