一 权限管理 初始版
结构
1.创建rbac应用
2.在models中创建对象
models
from django.db import models class Permission(models.Model): """ 权限表 """ title = models.CharField(verbose_name='标题',max_length=32) url = models.CharField(verbose_name="含正则URL",max_length=64) is_menu = models.BooleanField(verbose_name="是否是菜单") class Meta: verbose_name_plural = "权限表" def __str__(self): return self.title class User(models.Model): """ 用户表 """ username = models.CharField(verbose_name='用户名',max_length=32) password = models.CharField(verbose_name='密码',max_length=64) email = models.CharField(verbose_name='邮箱',max_length=32) roles = models.ManyToManyField(verbose_name='具有的所有角色',to="Role",blank=True) class Meta: verbose_name_plural = "用户表" def __str__(self): return self.username class Role(models.Model): """ 角色表 """ title = models.CharField(max_length=32) permissions = models.ManyToManyField(verbose_name='具有的所有权限',to='Permission',blank=True) class Meta: verbose_name_plural = "角色表" def __str__(self): return self.title
3.基于Django admin录入权限数据
注意;需要在admin.py 中作如下操作(只针对从用admin导入数据时配置,当然也可以从数据库中直接添加)
from django.contrib import admin from . import models admin.site.register(models.Permission) admin.site.register(models.User) admin.site.register(models.Role)
4.用户登录程序
根据输入的用户名和密码得到相应的user,
根据user对象获取其拥有的角色和具有的权限并去重并且将权限表中的url放入seesion中,将这部分操作的代码抽取到service包下的init_permission.py
下的init_permission(request,user)方法中,然后在views中调用该方法即可,
- 获取当前用户具有的所有权限(去重)
- 获取权限中的url,放置到session中
def init_permission(user,request): """ 初始化权限信息,获取权限信息并放置到session中。 :param user: :param request: :return: """ permission_list = user.roles.values('permissions__title', 'permissions__url', 'permissions__is_menu').distinct() url_list = [] for item in permission_list: url_list.append(item['permissions__url']) print(url_list) request.session['permission_url_list'] = url_list
5.编写中间件
import re from django.shortcuts import redirect,HttpResponse from django.conf import settings class MiddlewareMixin(object): def __init__(self, get_response=None): self.get_response = get_response super(MiddlewareMixin, self).__init__() def __call__(self, request): response = None if hasattr(self, 'process_request'): response = self.process_request(request) if not response: response = self.get_response(request) if hasattr(self, 'process_response'): response = self.process_response(request, response) return response class RbacMiddleware(MiddlewareMixin): def process_request(self,request): # 1. 获取当前请求的URL # request.path_info # 2. 获取Session中保存当前用户的权限 # request.session.get("permission_url_list') current_url = request.path_info # 当前请求不需要执行权限验证(白名单) for url in settings.VALID_URL: if re.match(url,current_url): return None permission_list = request.session.get("permission_url_list") if not permission_list: return redirect('/login/') flag = False for db_url in permission_list: regax = "^{0}$".format(db_url) if re.match(regax, current_url): flag = True break if not flag: return HttpResponse('无权访问')
a,获取当前访问的路径 request.path_info
b,在setting中配置不需要验证的url--白名单(人人登录后就可以访问的如login admin.*)然后调用
VALID_URL = [ "/login/", "/admin.*" ]
根据正则判断当前路径是否在白名单中,白名单中的路径要严格的控制以什么开头和以什么结尾,如果是白名单return None 继续执行后面的代码
如果不是直接跳转到登录
c,不是白名单的话,则判断是否已经登录,最简单的方法就是获取当前session 看是里面的url列表是否为空,如果为空的话说明没有登录,直接
调转到登陆,不让他执行后续操作
d,url list不为空的话就说明已经登陆了,进一步看当前的访问路径是否在是否在urllist中,在的话就说明用户具有操作该url的权限否则就说明该用户没有
访问权限,直接return HttpResponse("无权访问")
注意:中间件创建完成之后。需要在settings中的MIDDLEWARE最后添加'rbac.middlewares.rbac.RbacMiddleware',
MIDDLEWARE = [ 'django.middleware.security.SecurityMiddleware', 'django.contrib.sessions.middleware.SessionMiddleware', 'django.middleware.common.CommonMiddleware', 'django.middleware.csrf.CsrfViewMiddleware', 'django.contrib.auth.middleware.AuthenticationMiddleware', 'django.contrib.messages.middleware.MessageMiddleware', 'django.middleware.clickjacking.XFrameOptionsMiddleware', 'rbac.middlewares.rbac.RbacMiddleware', ]
示例一权限管理 加强
对于权限管理,不单单的只是控制能不能访问某个路径,而且还需要根据用户的权限,当用户访问某个页面时,在页面上展示什么,比如某些用户
虽然能访问首页,但是他没有添加用户的权限,这时就不能将添加按钮展现在首页,而对于具有添加用户权限的用户则需要将添加用户的按钮展示
在首页上
在访问列表页面时,是否需要判断:有无添加权限,有无删除权限,有无编辑权限;
1.在rbac下的models中添加Group类,在权限表中添加code字段和外键group
class Group(models.Model): """ 权限组 """ caption = models.CharField(verbose_name='组名称',max_length=16) class Permission(models.Model): """ 权限表 """ title = models.CharField(verbose_name='标题',max_length=32) url = models.CharField(verbose_name="含正则URL",max_length=64) is_menu = models.BooleanField(verbose_name="是否是菜单") code = models.CharField(verbose_name="代码",max_length=16) group = models.ForeignKey(verbose_name='所属组',to="Group") class Meta: verbose_name_plural = "权限表" def __str__(self): return self.title
2.在rbac/service/init_permission.py/init_permission类中进行修改
结构化数据模型
data = { 1: { 'codes': ['list','add','edit','del'], 'urls':[ /userinfo/, /userinfo/add/, /userinfo/edit/(\d+)/, /userinfo/del/(\d+)/, ] }, 2: { 'codes': ['list','add','edit','del'], 'urls':[ /userinfo/, /userinfo/add/, /userinfo/edit/(\d+)/, /userinfo/del/(\d+)/, ] }, }
permission_list = user.roles.values('permissions__title', "permissions__code", 'permissions__url', 'permissions__is_menu', "permissions__group__id", ).distinct() result={} for item in permission_list: groupid=item["permissions__group__id"] code=item["permissions__code"] url=item["permissions__url"] if groupid in result: result[groupid]["codes"].append(code) result[groupid]["urls"].append(url) else: result[groupid]={ "codes":[code,], "urls":[url,] } print(result) request.session[settings.PERMISSIONS_URL_DICT_KEY] = result
3.对中间件进行修改
import re from django.shortcuts import redirect,HttpResponse from django.conf import settings class MiddlewareMixin(object): def __init__(self, get_response=None): self.get_response = get_response super(MiddlewareMixin, self).__init__() def __call__(self, request): response = None if hasattr(self, 'process_request'): response = self.process_request(request) if not response: response = self.get_response(request) if hasattr(self, 'process_response'): response = self.process_response(request, response) return response class RbacMiddleware(MiddlewareMixin): def process_request(self,request): # 1. 获取当前请求的URL # request.path_info # 2. 获取Session中保存当前用户的权限 # request.session.get("permission_url_list') current_url = request.path_info # 当前请求不需要执行权限验证 for url in settings.VALID_URL: if re.match(url,current_url): return None permission_dict = request.session.get(settings.PERMISSION_URL_DICT_KEY) if not permission_dict: return redirect('/login/') flag = False for group_id,code_url in permission_dict.items(): for db_url in code_url['urls']: regax = "^{0}$".format(db_url) if re.match(regax, current_url): request.permission_code_list = code_url['codes'] flag = True break if flag: break if not flag: return HttpResponse('无权访问')
4.对views进行操作,是否页面上显示功能按钮:
方法1:在模块中进行判断
{% if "add/edit/del" in request.permission_code_list %} <a href="">添加/编辑/删除</a> {% endif%}
方法二:
在views中利用面向对象
class BasePagePermission(object): def __init__(self,code_list): self.code_list = code_list def has_add(self): if "add" in self.code_list: return True def has_edit(self): if 'edit' in self.code_list: return True def has_del(self): if 'del' in self.code_list: return True def userinfo(request): page_permission = BasePagePermission(request.permission_code_list) data_list = [ {'id':1,'name':'xxx1'}, {'id':2,'name':'xxx2'}, {'id':3,'name':'xxx3'}, {'id':4,'name':'xxx4'}, {'id':5,'name':'xxx5'}, ] return render(request,'userinfo.html',{'data_list':data_list,'page_permission':page_permission})
5.模块中进行判断
{% if pagepermission.has_add %} <p><a href="">添加</a></p> {% endif %}
示例二 菜单展示
1.在models中添加Menu对象(表)以及和Group建立起一对多的对应关系
from django.db import models class Menu(models.Model): """ 菜单组 """ title = models.CharField(max_length=32) class Group(models.Model): """ 权限组 """ caption = models.CharField(verbose_name='组名称',max_length=16) menu = models.ForeignKey(verbose_name='所属菜单',to='Menu') class Permission(models.Model): """ 权限表 """ title = models.CharField(verbose_name='标题',max_length=32) url = models.CharField(verbose_name="含正则URL",max_length=64) is_menu = models.BooleanField(verbose_name="是否是菜单") code = models.CharField(verbose_name="代码",max_length=16) group = models.ForeignKey(verbose_name='所属组',to="Group") class Meta: verbose_name_plural = "权限表" def __str__(self): return self.title class User(models.Model): """ 用户表 """ username = models.CharField(verbose_name='用户名',max_length=32) password = models.CharField(verbose_name='密码',max_length=64) email = models.CharField(verbose_name='邮箱',max_length=32) roles = models.ManyToManyField(verbose_name='具有的所有角色',to="Role",blank=True) class Meta: verbose_name_plural = "用户表" def __str__(self): return self.username class Role(models.Model): """ 角色表 """ title = models.CharField(max_length=32) permissions = models.ManyToManyField(verbose_name='具有的所有权限',to='Permission',blank=True) class Meta: verbose_name_plural = "角色表" def __str__(self): return self.title
2.- 初始化: 获取菜单信息+权限信息
from django.conf import settings def init_permission(user,request): """ 初始化权限信息,获取权限信息并放置到session中。 :param user: :param request: :return: """ permission_list = user.roles.values('permissions__title', # 用户列表 'permissions__url', 'permissions__code', 'permissions__is_menu', # 是否是菜单 'permissions__group_id', 'permissions__group__menu_id', # 菜单ID 'permissions__group__menu__title',# 菜单名称 ).distinct() menu_list = [] # 去掉不是菜单的URL for item in permission_list: if not item['permissions__is_menu']: continue tpl = { 'menu_id':item['permissions__group__menu_id'], 'menu_title':item['permissions__group__menu__title'], 'title':item['permissions__title'], 'url':item['permissions__url'], 'active':False, } menu_list.append(tpl) request.session[settings.PERMISSION_MENU_KEY] = menu_list # 权限相关 result = {} for item in permission_list: group_id = item['permissions__group_id'] code = item['permissions__code'] url = item['permissions__url'] if group_id in result: result[group_id]['codes'].append(code) result[group_id]['urls'].append(url) else: result[group_id] = { 'codes':[code,], 'urls':[url,] } request.session[settings.PERMISSION_URL_DICT_KEY] = result
结构化数据 示例;
mport re menu_list = [ {'menu_id':1, 'menu_title':'菜单一','title':'用户列表','url':'/userinfo/','active':False}, {'menu_id':1, 'menu_title':'菜单一','title':'订单列表','url':'/order/','active':False}, {'menu_id':2, 'menu_title':'菜单二','title':'xxx列表','url':'/xxx/','active':False}, {'menu_id':2, 'menu_title':'菜单二','title':'iii列表','url':'/uuu/','active':False}, ] current_url = "/userinfo/" res={} for tem in menu_list: mid=tem["menu_id"] mtitle=tem["menu_title"] title=tem["title"] url=tem["url"] active=False if re.match(url,current_url): active=True if mid in res: res[mid]["children"].append({"title":title,"url":url,"active":active}) if active: res[mid]["active"]=True else: res[mid]={ "menu_id":mid, "menu_title":mtitle, "active":active, "children":[ {"title":title,"url":url,"active":True}, ] } print(res)
结果:
aa={ 1: { 'menu_id': 1, 'menu_title': '菜单一', 'active': True, 'children': [{'title': '用户列表', 'url': '/userinfo/', 'active': True}, {'title': '订单列表', 'url': '/order/', 'active': True}] }, 2: { 'menu_id': 2, 'menu_title': '菜单二', 'active': True, 'children': [{'title': 'xxx列表', 'url': '/xxx/', 'active': True}, {'title': 'iii列表', 'url': '/uuu/', 'active': True}] } }
3.显示多级菜单
模块中操作
其中菜单部分由自定义标签生产
具体展示页面则用模块继承:如userinfo
a. base.html
{% load rbac %} <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <title>Title</title> <link rel="stylesheet" href="/static/rbac/rbac.css"> </head> <body> <div style="float: left;width: 20%;height: 900px;background-color: darkgrey"> {% menu_html request %} </div> <div style="float: left;width: 80%"> {% block content %} {% endblock %} </div> </body> <script src="/static/jquery-3.2.1.min.js"></script> <script src="/static/rbac/rbac.js"></script> </html>
b. userinfo.html
{% extends "base.html" %} {% block content %} {% if pagepermission.has_add %} <p><a href="">添加</a></p> {% endif %} <table> <thead> <th>id</th> <th>name</th> <th>操作</th> </thead> <tbody> {% for foo in data_list %} <tr> <td>{{ foo.id }}</td> <td>{{ foo.name }}</td> <td> {% if pagepermission.has_edit %} <a href="#">编辑</a> {% endif %} {% if pagepermission.has_del %} <a href="#">删除</a> {% endif %} </td> </tr> {% endfor %} {% endblock %}
c.建立自定义标签
rbac/templatetags/rabc.py
import re from django.template import Library from django.conf import settings register = Library() @register.inclusion_tag("menuList.html") def menu_html(request): menu_list = request.session[settings.PERMISSION_MENU_KEY] current_url = request.path_info result = {} for item in menu_list: url = item['url'] regex = "^{0}$".format(url) active = False if re.match(regex,current_url): active = True menu_id = item['menu_id'] if menu_id in result: result[menu_id]['children'].append({'title': item['title'], 'url': item['url'], 'active': active}) if active: result[menu_id]['active'] = True else: result[menu_id] = { 'menu_id': menu_id, 'menu_title': item['menu_title'], 'active': active, 'children': [ {'title': item['title'], 'url': item['url'], 'active': active}, ] } return {'menu_dict':result}
d. menuList.html
{% for k,item in menu_dict.items %} <div class="item"> <div class="item_title">{{ item.menu_title }}</div> {% if item.active %} <div class="item_permissions"> {% else %} <div class="item_permissions hide"> {% endif %} {% for v in item.children %} {% if v.active %} <a href="#" class="active">{{ v.title }}</a> {% else %} <a href="#">{{ v.title }}</a> {% endif %} {% endfor %} </div> </div> {% endfor %}
e.相关css和js
在rbac建立static/rbac目录在其中创建rabc.css和rabc.js
.item_permissions{ padding: 3px 10px; } .item_permissions a{ display: block; } .item_permissions a.active{ color: red; } .hide{ display: none; }
$(function () { $(".item_title").click(function () { $(this).next().toggleClass("hide") }); })
四.菜单展示改进
因为当我们对用户部分进行增删改时,用户列表也应该事展开的,但是我们上面所写的当我们点击增加删除编辑按钮时,用户菜单会闭合而不是展开的
对此我们进行了改进
1..在权限表中增加字段menu_gp,并删除is_menu字段
from django.db import models class Menu(models.Model): ''' 菜单表 ''' title=models.CharField(max_length=32,verbose_name="菜单名称") class Group(models.Model): ''' 权限组 ''' caption=models.CharField(max_length=32,verbose_name="组名称") menu=models.ForeignKey(verbose_name="所属菜单",to="Menu",default=1) class Permission(models.Model): """ 权限表 """ title = models.CharField(verbose_name='标题',max_length=32) url = models.CharField(verbose_name="含正则URL",max_length=64) # is_menu = models.BooleanField(verbose_name="是否是菜单") menu_gp=models.ForeignKey(verbose_name="组内菜单",to="Permission",null=True,blank=True) code=models.CharField(max_length=32,verbose_name="代码",default="list") group=models.ForeignKey(verbose_name="s所在权限组",to="Group",default=1) class Meta: verbose_name_plural = "权限表" def __str__(self): return self.title class User(models.Model): """ 用户表 """ username = models.CharField(verbose_name='用户名',max_length=32) password = models.CharField(verbose_name='密码',max_length=64) email = models.CharField(verbose_name='邮箱',max_length=32) roles = models.ManyToManyField(verbose_name='具有的所有角色',to="Role",blank=True) class Meta: verbose_name_plural = "用户表" def __str__(self): return self.username class Role(models.Model): """ 角色表 """ title = models.CharField(max_length=32) permissions = models.ManyToManyField(verbose_name='具有的所有权限',to='Permission',blank=True) class Meta: verbose_name_plural = "角色表" def __str__(self): return self.title
2.修改初始化中菜单
from django.conf import settings def init_permission(user,request): """ 初始化权限信息,获取权限信息并放置到session中。 :param user: :param request: :return: """ permission_list = user.roles.values('permissions__title', "permissions__code", "permissions__id", 'permissions__url', 'permissions__menu_gp_id', "permissions__group__id", "permissions__group__menu_id", "permissions__group__menu__title", ).distinct() menu_list=[] for item in permission_list: tpl={ "id":item["permissions__id"], "title":item["permissions__title"], "menu_title":item["permissions__group__menu__title"], "url":item["permissions__url"], "menu_id":item["permissions__group__menu_id"], "menu_gp_id":item["permissions__menu_gp_id"], } menu_list.append(tpl) request.session[settings.PERMISSIONS_MENU_KEY]=menu_list # menu_list=[] # for item in permission_list: # if not item["permissions__is_menu"]: # continue # # tpl={ # "menu_id":item["permissions__group__menu_id"], # "menu_title":item["permissions__group__menu__title"], # "title":item["permissions__title"], # "url":item["permissions__url"], # "active":False, # } # # menu_list.append(tpl) # print(menu_list) # request.session[settings.PERMISSIONS_MENU_KEY]=menu_list #权限管理 result={} for item in permission_list: groupid=item["permissions__group__id"] code=item["permissions__code"] url=item["permissions__url"] if groupid in result: result[groupid]["codes"].append(code) result[groupid]["urls"].append(url) else: result[groupid]={ "codes":[code,], "urls":[url,] } print(result) request.session[settings.PERMISSIONS_URL_DICT_KEY] = result
3.修改定义标签
import re from django.conf import settings from django.template import Library register = Library() @register.inclusion_tag("menuList.html") def menu_html(request): menu_list=request.session.get(settings.PERMISSIONS_MENU_KEY) currenturl=request.path_info menu_dict={} for item in menu_list: if not item["menu_gp_id"]: menu_dict[item["id"]]=item for item in menu_list: regex="^{0}$".format(item["url"]) if re.match(regex,currenturl): menu_gp_id=item["menu_gp_id"] if not menu_gp_id: menu_dict[item["id"]]["active"]=True else: menu_dict[item["menu_gp_id"]]["active"]=True ''' menu_dict={ 1: {'id': 1, 'title': '用户列表', 'url': '/userinfo/', 'menu_gp_id': None, 'menu_id': 1, 'menu_title': '菜单管理', 'active': True}, 5: {'id': 5, 'title': '订单列表', 'url': '/order/', 'menu_gp_id': None, 'menu_id': 2, 'menu_title': '菜单2'}} ''' print(menu_dict,"11111111111111111111111111111111111111111111") result = {} for item in menu_dict.values(): menu_id=item["menu_id"] menu_title=item["menu_title"] active=item.get("active") url=item["url"] title=item["title"] if menu_id in result: result[menu_id]["children"].append({"title":title,"url":url,"active":active}) if active: result[menu_id]["active"]=True else: result[menu_id]={ "menu_id":menu_id, "menu_title":menu_title, "active":active, "children":[ {"title":title,"url":url,"active":active}, ] } print(result) # for item in menu_list: # menu_id=item["menu_id"] # menu_title=item["menu_title"] # title=item["title"] # url=item["url"] # active=False # regex="^{0}$".format(url) # if re.match(regex,currenturl): # active=True # # if menu_id in result: # result[menu_id]["children"].append({{"title":title,"url":url,"active":active},}) # if active: # result[menu_id]["active"]=active # else: # result[menu_id]={ # "menu_id":menu_id, # "menu_title":menu_title, # "active":active, # "children":[ # {"title":title,"url":url,"active":active}, # ] # } # print(result) return {"menu_dict":result}
其他不做修改
出处:https://www.cnblogs.com/ctztake/p/7812041.html
flask role
from app import db
from werkzeug.security import generate_password_hash,check_password_hash
from flask_login import UserMixin,AnonymousUserMixin
from itsdangerous import TimedJSONWebSignatureSerializer as Serializer
from datetime import datetime
from flask import url_for
class Role(db.Model):
__tablename__='role'
id=db.Column(db.Integer,primary_key=True)
name=db.Column(db.String(64),unique=True)
permission=db.Column(db.Integer)
users=db.relationship('User',backref='role',lazy='dynamic')
def __repr__(self):
return '<Role %r>'% self.name
class Permission:
FOLLOW=0x01
COMMENT=0x02
WRITE=0x04
MANAGE_COMMENTS=0x08
ADMIN=0x80
class User(db.Model,UserMixin):
__tablename__='users'
id=db.Column(db.Integer,primary_key=True)
username=db.Column(db.String(64),unique=True,index=True)
role_id=db.Column(db.Integer,db.ForeignKey('role.id'))
hash_password=db.Column(db.String(28))
confirmed=db.Column(db.Boolean,default=False)
def __init__(self,**kwargs):
super(User,self).__init__(**kwargs)
if self.role is None:
if self.username == 'Hyman':
self.role=Role.query.filter_by(permission=0x8f).first()
if self.role is None:
self.role=Role.query.filter_by(permission=0x07).first()
def can(self,permission):
return self.role is not None and (self.role.permission & permission) == permission
def is_admin(self):
return self.can(Permission.ADMIN)
def generate_token(self,expiration=3600):
s=Serializer('secret key',expiration)
return s.dumps({'confirm':self.id})
def confirm(self,token):
s=Serializer('secret key')
data=s.loads(token)
if data.get('confirm')!=self.id:
return False
self.confirm = True
db.session.add(self)
return True
def __repr__(self):
return '<User %r>'% self.username
@property
def password(self):
raise AttributeError('password cannot be read');
@password.setter
def password(self,password):
self.hash_password=generate_password_hash(password)
def confirm_password(self,password):
return check_password_hash(self.hash_password,password)
class AnonymousUser(AnonymousUserMixin):
def can(self,permission):
return False
def is_admin(self):
return False
from . import loginmanager
@loginmanager.user_loader
def load_user(id):
return User.query.get(int(id))
loginmanager.anonymous_user=AnonymousUser
def create_roles():
roles={'User':Permission.FOLLOW|Permission.COMMENT|Permission.WRITE,
'Moderator':Permission.FOLLOW|Permission.COMMENT|Permission.WRITE|Permission.MANAGE_COMMENTS,
'Admin':Permission.FOLLOW|Permission.COMMENT|Permission.WRITE|Permission.MANAGE_COMMENTS|Permission.ADMIN
}
for r in roles:
print r
role = Role.query.filter_by(name=r).first()
if role is None:
role=Role(name=r)
role.permission=roles[r]
db.session.add(role)
db.session.commit()
from markdown import markdown
import bleach
class Post(db.Model):
__tablename__='posts'
id=db.Column(db.Integer,primary_key=True)
body=db.Column(db.Text)
timestamp=db.Column(db.DateTime,index=True,default=datetime.utcnow)
html_body=db.Column(db.Text)
def to_json(self):
json_post={
'url':url_for('main.get_post',id=self.id,_external=True),
'body':self.body,
'html_body':self.html_body
}
return json_post
@staticmethod
def from_json(json_post):
body=json_post.get('body')
return Post(body=body)
@staticmethod
def on_body_change(target,value,oldvalue,initiator):
allowed_tags=['a','ul','strong','p','h1','h2','h3']
html_body=markdown(value,output_format='html')
html_body=bleach.clean(html_body,tags=allowed_tags,strip=True)
html_body=bleach.linkify(html_body)
target.html_body=html_body
db.event.listen(Post.body,'set',Post.on_body_change)