淘淘商城08_权限拦截器04

把用户的权限和菜单存放到session中

SysPermissionUserMapper：

package com.taotao.mapper;

import java.util.List;

import com.taotao.pojo.SysPermission;

public interface SysPermissionUserMapper {
	//根据用户id查询用户菜单
	List<SysPermission> getMenuByUserId(String userId);
	
	//根据用户id查询用户权限
	List<SysPermission> getPermissionUrlByUserId(String userId);
}

SysPermissionUserMapper.xml

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd" >
<mapper namespace="com.taotao.mapper.SysPermissionUserMapper" >
 	<!-- 查询用户菜单 -->
 	<select id="getMenuByUserID" parameterType="String" resultType="com.taotao.pojo.SysPermission">
 		SELECT
			*
		FROM
			sys_permission
		WHERE
			type = 'menu'
		AND id IN (
			SELECT
				sys_permission_id
			FROM
				sys_role_permission
			WHERE
				sys_role_id IN (
					SELECT
						sys_role_id
					FROM
						sys_user_role
					WHERE
						sys_user_id = #{userid}
				)
		)
 	</select>
 	
 		<!-- 查询用户权限URL -->
 	<select id="getPermissionByUserID" parameterType="String" resultType="com.taotao.pojo.SysPermission">
 		SELECT
			*
		FROM
			sys_permission
		WHERE
			type = 'permission'
		AND id IN (
			SELECT
				sys_permission_id
			FROM
				sys_role_permission
			WHERE
				sys_role_id IN (
					SELECT
						sys_role_id
					FROM
						sys_user_role
					WHERE
						sys_user_id = #{userid}
				)
		)
 	</select>
 	
 	
</mapper>

SysPermissionService:

package com.taotao.service;

import java.util.List;

import com.taotao.pojo.SysPermission;
import com.taotao.pojo.SysUser;
import com.taotao.utils.TaotaoResult;
/**
 * 用户认证接口
 * @author fengjinzhu
 *
 */
public interface SysPermissionService {
	//用户认证
	 public TaotaoResult authenticat(String usercode, String password);
	
	 //查询用户
	 public SysUser getSysUser(String usercode);
	 
	//根据用户id查询用户菜单
		List<SysPermission> getMenuByUserId(String userId);
		
		//根据用户id查询用户权限
		List<SysPermission> getPermissionUrlByUserId(String userId);
}

 SysPermissionServiceImpl

package com.taotao.service;

import java.util.List;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;
import org.springframework.util.DigestUtils;

import com.taotao.mapper.SysPermissionUserMapper;
import com.taotao.mapper.SysUserMapper;
import com.taotao.pojo.ActiveUser;
import com.taotao.pojo.SysPermission;
import com.taotao.pojo.SysUser;
import com.taotao.utils.TaotaoResult;

@Service
public class SysPermissionServiceImpl implements SysPermissionService {
	@Autowired
	private SysUserMapper sysUserMapper;
	
	@Autowired
	private SysPermissionUserMapper sysPermissionUserMapper;

	@Override
	public TaotaoResult authenticat(String usercode, String password) {
		//1.获取该对象
		SysUser sysUser = this.getSysUser(usercode);
		//2.判断该用户 是否存在
		if (sysUser == null) {
			return TaotaoResult.build(400, "该用户不存在！");
		}
		
		//判断用户的密码
		//从数据库中取出该用户的密码，该密码是经过Md5加密的
		String pwd_db = sysUser.getPassword();
		//1.获取该用户的盐值
		String salt = sysUser.getSalt();
		//2.获取前台输入的密码password
		//3.将盐值和password相加后加密
		String salt_pwd = salt+password;
		//获取到该用户输入的密码，将输入的密码经过MD5加密
		String pwd_input = DigestUtils.md5DigestAsHex(salt_pwd.getBytes());
		//与数据库中取出的密码相比较
		if (! pwd_db.equalsIgnoreCase(pwd_input)) {
			return TaotaoResult.build(400, "用户名或密码错误！");
		}
		
		//将数据添加到activeUser类中
		ActiveUser activeUser = new ActiveUser();
		activeUser.setUsercode(usercode);
		activeUser.setUsername(sysUser.getUsername());
		activeUser.setUserid(sysUser.getId());
		
		return TaotaoResult.ok(activeUser);
	}
	
	public SysUser getSysUser(String usercode){
		SysUser sysUser = new SysUser();    
		sysUser.getUsercode();
		List<SysUser> list = sysUserMapper.getSysUserByCode(usercode);
		if (list !=null && list.size() >0) {
			 return  list.get(0);
		}
		return null;
	}

	@Override
	public List<SysPermission> getMenuByUserId(String userId) {
		// TODO Auto-generated method stub
		return sysPermissionUserMapper.getMenuByUserId(userId);
	}

	@Override
	public List<SysPermission> getPermissionUrlByUserId(String userId) {
		// TODO Auto-generated method stub
		return sysPermissionUserMapper.getPermissionUrlByUserId(userId);
	}
}

 

 

package com.taotao.service;

import java.util.List;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;
import org.springframework.util.DigestUtils;

import com.taotao.mapper.SysPermissionUserMapper;
import com.taotao.mapper.SysUserMapper;
import com.taotao.pojo.ActiveUser;
import com.taotao.pojo.SysPermission;
import com.taotao.pojo.SysUser;
import com.taotao.utils.TaotaoResult;

@Service
public class SysPermissionServiceImpl implements SysPermissionService {
	@Autowired
	private SysUserMapper sysUserMapper;
	
	@Autowired
	private SysPermissionUserMapper sysPermissionUserMapper;

	@Override
	public TaotaoResult authenticat(String usercode, String password) {
		//1.获取该对象
		SysUser sysUser = this.getSysUser(usercode);
		//2.判断该用户 是否存在
		if (sysUser == null) {
			return TaotaoResult.build(400, "该用户不存在！");
		}
		
		//判断用户的密码
		//从数据库中取出该用户的密码，该密码是经过Md5加密的
		String pwd_db = sysUser.getPassword();
		//1.获取该用户的盐值
		String salt = sysUser.getSalt();
		//2.获取前台输入的密码password
		//3.将盐值和password相加后加密
		String salt_pwd = salt+password;
		//获取到该用户输入的密码，将输入的密码经过MD5加密
		String pwd_input = DigestUtils.md5DigestAsHex(salt_pwd.getBytes());
		//与数据库中取出的密码相比较
		if (! pwd_db.equalsIgnoreCase(pwd_input)) {
			return TaotaoResult.build(400, "用户名或密码错误！");
		}
		
		String userId = sysUser.getId();
		//将数据添加到activeUser类中
		ActiveUser activeUser = new ActiveUser();
		activeUser.setUsercode(usercode);
		activeUser.setUsername(sysUser.getUsername());
		activeUser.setUserid(sysUser.getId());
		
		activeUser.setMenus(this.getMenuByUserId(userId));//权限 菜单
		activeUser.setPermissions(this.getPermissionUrlByUserId(userId));//权限url
		
		return TaotaoResult.ok(activeUser);
	}
	
	public SysUser getSysUser(String usercode){
		SysUser sysUser = new SysUser();    
		sysUser.getUsercode();
		List<SysUser> list = sysUserMapper.getSysUserByCode(usercode);
		if (list !=null && list.size() >0) {
			 return  list.get(0);
		}
		return null;
	}

	@Override
	public List<SysPermission> getMenuByUserId(String userId) {
		// TODO Auto-generated method stub
		return sysPermissionUserMapper.getMenuByUserId(userId);
	}

	@Override
	public List<SysPermission> getPermissionUrlByUserId(String userId) {
		// TODO Auto-generated method stub
		return sysPermissionUserMapper.getPermissionUrlByUserId(userId);
	}
}

PermissionInterceptor.java

package com.taotao.interceptor;

import java.util.List;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

import org.springframework.web.servlet.HandlerInterceptor;
import org.springframework.web.servlet.ModelAndView;

import com.taotao.pojo.ActiveUser;
import com.taotao.pojo.SysPermission;
import com.taotao.utils.ResourcesUtil;

public class PermissionInterceptor implements HandlerInterceptor {

	@Override
	public void afterCompletion(HttpServletRequest arg0, HttpServletResponse arg1, Object arg2, Exception arg3)
			throws Exception {
		// TODO Auto-generated method stub
		//执行后
	}

	@Override
	public void postHandle(HttpServletRequest arg0, HttpServletResponse arg1, Object arg2, ModelAndView arg3)
			throws Exception {
		// TODO Auto-generated method stub
		//执行前
	}

	@Override
	public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object arg2) throws Exception {
		//1.获取到请求的URL
		String url = request.getRequestURI();
		//2.判断，公共的资源给放行，否则拦截
		//用工具类ResourcesUtil.java读取commonURL.properties，返回一个list集合,读取commonURL.properties中的key值
		List<String> opencomm_url = ResourcesUtil.gekeyList("commonURL");
		for (String opencomm_urls : opencomm_url) {
			if (url.indexOf(opencomm_urls)>=0) {
				return true;
			}
		}
		
		HttpSession session = request.getSession();//获取到session
		ActiveUser activeUser = (ActiveUser) session.getAttribute("activeUser");//获取到session中存储的activeUser
		
		//从session中取出permission的url
		//把url进行遍历，放行
		List<SysPermission> permissionList = activeUser.getPermissions();
		for (SysPermission sysPermission : permissionList) {
			//取出url字段，只要数据库中有的就放行
			String openPermissionUrl = sysPermission.getUrl();
			if (url.indexOf(openPermissionUrl)>=0) {
				return true;
			}
		}
		
		//跳转页面,不放行的就 无权访问
		request.getRequestDispatcher("/WEB-INF/jsp/refuse.jsp").forward(request, response);
		return false;
	}

}

 

commonURL.properties

#公开的url
/index=首页

springmvc.xml

<!-- 用户权限拦截 -->
		<mvc:interceptor>
			<mvc:mapping path="/**"/>
			<mvc:exclude-mapping path="/**/fonts/*"/>
	        <mvc:exclude-mapping path="/**/*.css"/>
	        <mvc:exclude-mapping path="/**/*.js"/>
	        <mvc:exclude-mapping path="/**/*.png"/>
	        <mvc:exclude-mapping path="/**/*.gif"/>
	        <mvc:exclude-mapping path="/**/*.jpg"/>
	        <mvc:exclude-mapping path="/**/*.jpeg"/>
	        <mvc:exclude-mapping path="/**/*validatecode*"/>
	        <mvc:exclude-mapping path="/**/*Login*"/>
	        <mvc:exclude-mapping path="/**/*error*"/>
			<bean class="com.taotao.interceptor.PermissionInterceptor"/>
		</mvc:interceptor>