如何做权限验证

 首先每个按钮下面做:

 if (!UICommon.HasOperationRight(UserId, "commit", this))
            {
                return;
            }

 接着HasOperationRight方法定义为:

       /// <summary>
        /// 核实是否有对应页面（URL）.相应操作的权限
        /// </summary>
        /// <returns></returns>
        public static bool HasOperationRight(string userId,string commandName,Page page,bool hasCloseWin)
        {  
            bool hasRight = false;
            string furl = ((System.Web.UI.TemplateControl)(page)).AppRelativeVirtualPath;
            BRight rightBiz = new BRight();

            if (!rightBiz.CheckHasRight(Convert.ToInt32(userId), furl, commandName, 1))
            {
                MsgBox("对不起，您没有此功能的操作权限!",page);
                hasRight = false;
            }
            else
            {
                hasRight = true;
            }
            return hasRight;
        }

最后CheckHasRight方法定义为:

        /// <summary>
        /// 核实是否有对应页面（URL）.相应操作的权限
        /// </summary>
        /// <param name="userId"></param>
        /// <param name="furl"></param>
        /// <param name="commandName"></param>
        /// <param name="rightTypeId"></param>
        /// <returns></returns>
        public bool CheckHasRight(int userId,string furl ,string commandName,int rightTypeId)
        {
            bool hasRight = false;
            StringBuilder sql = new StringBuilder();
            sql.Append(" select ro.id from RGT_OBJECTCOMMAND ro ");
            sql.Append(" where COMMANDID =( ");
            sql.Append("                  select rc.commandid from RGT_COMMAND rc ");
            sql.Append("                  where rc.COMMANDEXP=:COMMANDEXP)");
            sql.Append(" and rightobjectID =");
            sql.Append("                  (select sf.fmid from Sys_Function sf ");
            sql.Append("                  where sf.Fmurl=:Fmurl");
            sql.Append("                  )");
            sql.Append(" and ro.id in ");
            sql.Append("                  ( select OBJECTCOMMANDID from rgt_usergroupright ");
            sql.Append("                  join sys_usergroup on rgt_usergroupright.usergroupid =");
            sql.Append("                  sys_usergroup.usergroupid ");
            sql.Append("                  join sys_groupuser on sys_usergroup.usergroupid =");
            sql.Append("                  sys_groupuser.usergroupid ");
            sql.Append("                  join rgt_objectcommand on rgt_usergroupright.objectcommandid =");
            sql.Append("                  rgt_objectcommand.id ");
            sql.Append("                  join rgt_command on  rgt_objectcommand.commandid=");
            sql.Append("                  rgt_command.commandid ");
            sql.Append("                  where rgt_objectcommand.righttypeid =:Righttypeid");
            sql.Append("                  and sys_groupuser.userid =:Userid) ");
            OracleParameter[] parameters = {
                                               new OracleParameter(":COMMANDEXP", commandName),
                                               new OracleParameter(":Fmurl", furl),
                                               new OracleParameter(":Righttypeid", rightTypeId.ToString()),
                                               new OracleParameter(":Userid", userId.ToString())
                                           };
            OracleDataReader sdr = OracleHelper.ExecuteReader(DbConfig.ConnString, CommandType.Text, sql.ToString(), parameters);
            while (sdr.Read())
            {
                int ObjectId = -1;
                try
                {
                    ObjectId = DBReaderManipulter.GetInstance().GetIntValue(sdr, "ID");
                   if(ObjectId>0)
                   {
                       hasRight = true;
                   }
                }
                catch 
                {
                    hasRight = false;
                }
              
            }
            return hasRight;
        }