com.liferay.portal.kernel.portlet.LiferayPortlet.StrutsPortlet中获取方式: PermissionChecker permissionChecker = PermissionThreadLocal.getPermissionChecker(); com.liferay.portlet.journal.service.permission.JournalArticlePermission 页面中: JournalArticlePermission.contains(permissionChecker, article, ActionKeys.UPDATE) 页面中直接拿permissionChecker对象是通过com.liferay.taglib.theme.DefineObjectsTei定义的: new VariableInfo( "permissionChecker", PermissionChecker.class.getName(), true, VariableInfo.AT_END), JournalArticlePermission:>>>>> public static boolean contains( PermissionChecker permissionChecker, JournalArticle article, String actionId) { if (permissionChecker.hasOwnerPermission( article.getCompanyId(), JournalArticle.class.getName(), article.getResourcePrimKey(), article.getUserId(), actionId)) { return true; } return permissionChecker.hasPermission( article.getGroupId(), JournalArticle.class.getName(), article.getResourcePrimKey(), actionId); } //通过ThemeDisplay也可以拿permissionChecker ThemeDisplay themeDisplay = (ThemeDisplay)request.getAttribute( WebKeys.THEME_DISPLAY); PermissionChecker permissionChecker = themeDisplay.getPermissionChecker(); //================================================== //通过PermissionThreadLocal也可以拿permissionChecker PermissionChecker permissionChecker = PermissionThreadLocal.getPermissionChecker(); 为什么? 因为>>:PermissionCheckerUtil public static void setThreadValues(User user) { long userId = user.getUserId(); String name = String.valueOf(userId); PrincipalThreadLocal.setName(name); try { PermissionChecker permissionChecker = PermissionThreadLocal.getPermissionChecker(); if (permissionChecker == null) { permissionChecker = (PermissionChecker)Class.forName( PropsValues.PERMISSIONS_CHECKER).newInstance(); /** PropsValues.PERMISSIONS_CHECKER PropsValues>>> public static final String PERMISSIONS_CHECKER = PropsUtil.get(PropsKeys.PERMISSIONS_CHECKER); //就是PropsUtil.get("permissions.checker"); portal.properties>>>>: permissions.checker=com.liferay.portal.security.permission.AdvancedPermissionChecker */ } permissionChecker.init(user, _CHECK_GUEST); PermissionThreadLocal.setPermissionChecker(permissionChecker); } catch (Exception e) { _log.error(e); 什么时候在哪里会调用PermissionCheckerUtil.setThreadValues(user);呢? 两个地方: 1)MessageListenerImpl类的方法deliver中: PermissionCheckerUtil.setThreadValues(user); 2)MailingListMessageListener类的方法processMessage中:PermissionCheckerUtil.setThreadValues(user); 继续问,什么时候操作MessageListener? 在MainServlet的init方法中: try { Iterator<Portlet> itr = portlets.iterator(); while (itr.hasNext()) { Portlet portlet = itr.next(); MessageListener popMessageListener = portlet.getPopMessageListenerInstance(); if (!portlet.isActive() || (popMessageListener == null)) { continue; } POPServerUtil.addListener(popMessageListener); /*上面这个方法会调用 _instance._addListener(listener); 而_instance:private static POPServerUtil _instance = new POPServerUtil(); */ } } catch (Exception e) { _log.error(e, e); } //============================权限验证方式二========================================= PermissionLocalServiceImpl: boolean hasUserPermission(long userId, String actionId, long resourceId) resourceId是什么东西? //=========================权限验证方式三=========================================== PortletPermissionUtil: public static boolean contains(PermissionChecker permissionChecker, long plid, String portletId,String actionId) throws PortalException, SystemException{} 怎么获取plid和portletId? (分别数据库表PORTLETPREFERENCES 的字段PLID和PORTLETID)====>>>>>>> ThemeDisplay themeDisplay = (ThemeDisplay)request.getAttribute(WebKeys.THEME_DISPLAY); long plId=themeDisplay.getPlid(); String portletId=themeDisplay.getPortletDisplay().getId(); 实战代码: PermissionChecker permissionChecker=PermissionThreadLocal.getPermissionChecker(); ThemeDisplay themeDisplay = (ThemeDisplay)request.getAttribute(WebKeys.THEME_DISPLAY); long plId=themeDisplay.getPlid(); String portletId=themeDisplay.getPortletDisplay().getId(); if( PortletPermissionUtil.contains(permissionChecker,plId,portletId,ActionKeys.CONFIGURATION)){ //做你想做的事 }