/**
* 验证当前管理员权限是否可以进行操作
*
* @param string $link_nav
* @return
*/
protected final function checkPermission($link_nav = null){
if ($this->admin_info['sp'] == 1) return true;
$act = $_GET['act']?$_GET['act']:$_POST['act'];
$op = $_GET['op']?$_GET['op']:$_POST['op'];
if (empty($this->permission)){
$gadmin = Model('gadmin')->getby_gid($this->admin_info['gid']);
$permission = decrypt($gadmin['limits'],MD5_KEY.md5($gadmin['gname']));//md5()计算字符串MD5散列
$this->permission = $permission = explode('|',$permission);
}else{
$permission = $this->permission;
}
//显示隐藏小导航,成功与否都直接返回
if (is_array($link_nav)){
if (!in_array("{$link_nav['act']}.{$link_nav['op']}",$permission) && !in_array($link_nav['act'],$permission)){
return false;
}else{
return true;
}
}
//以下几项不需要验证
$tmp = array('index','dashboard','login','common','cms_base');
if (in_array($act,$tmp)) return true; //在$tmp数组中搜寻是否存在值$act
if (in_array($act,$permission) || in_array("$act.$op",$permission)){
return true;
}else{
$extlimit = array('ajax','export_step1');
if (in_array($op,$extlimit) && (in_array($act,$permission) || strpos(serialize($permission),'"'.$act.'.'))){
return true;
}
//带前缀的都通过
foreach ($permission as $v) {
if (!empty($v) && strpos("$act.$op",$v.'_') !== false) {
return true;break;
}
}
}
showMessage(Language::get('nc_assign_right'),'','html','succ',0);
}
转载于:https://www.cnblogs.com/asdfgh/p/4874682.html