后端(用于controller的方法上)
引入的包
import org.apache.shiro.authz.annotation.Logical;
import org.apache.shiro.authz.annotation.RequiresPermissions;
- @RequiresPermissions(“set:data:list”) //只要一个控制时
- @RequiresPermissions(value = {“set:data:add”, “set:data:edit”}, logical = Logical.OR) //多个控制,且其关系为“或”
- @RequiresPermissions(value = {“set:data:add”, “set:data:edit”}, logical = Logical.AND) //多个控制,且其关系为“且”
例子1(单权限)
// 进入添加页,
@RequiresPermissions("set:data:add")//进入该方法所需的权限
@RequestMapping(value = "set/data/add", method = RequestMethod.GET)
public String add() {
return "set/data/add";
}
例子2(多权限)
// 保存
@RequiresPermissions(value = {"set:data:add", "set:data:edit"}, logical = Logical.OR) //进入该方法所需的权限
@RequestMapping(value = "set/data/save", method = RequestMethod.POST)
public KZResult save(DictType dictType) {
if (dictTypeService.selectByDictName(dictType.getDictName())) {
try {
dictTypeService.insertDictType(dictType);
return KZResult.ok();
} catch (Exception e) {
return KZResult.error(1, "添加失败");
}
}else{
return KZResult.error(1, "字典名称已存在");
}
}
后端(用于shiroConfig)
写在shiroConfig和写在controller实现效果一样
@Bean
ShiroFilterFactoryBean shiroFilterFactoryBean(SecurityManager securityManager) {
ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
// Shiro的核心安全接口,这个属性是必须的
shiroFilterFactoryBean.setSecurityManager(securityManager);
// 身份认证失败,则跳转到登录页面的配置
shiroFilterFactoryBean.setLoginUrl("/login");
// 权限认证成功,则跳转到index主页面
shiroFilterFactoryBean.setSuccessUrl("/index");
// 权限认证失败,则跳转到指定页面
shiroFilterFactoryBean.setUnauthorizedUrl("/error/unauthorized");
LinkedHashMap<String, String> filterChainDefinitionMap = new LinkedHashMap<>();
filterChainDefinitionMap.put("/css/**", "anon");
filterChainDefinitionMap.put("/js/**", "anon");
//put的第一位参数是请求地址,第二位参数是所需权限
//anon表示需要认证通过,perms[set:data:add]表示需要有set:data:add权限
//需同时满足anon和set:data:add
filterChainDefinitionMap.put("set/data/add", "anon,perms[set:data:add]");
//需同时满足anon和set:data:add和set:data:edit
filterChainDefinitionMap.put("set/data/save", "anon,perms[set:data:add,set:data:edit]");
// 退出 logout地址,shiro去清除session
filterChainDefinitionMap.put("/logout", "logout");
shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
return shiroFilterFactoryBean;
}
前端(用于标签上,eg:button、div)
1、html
前端与thymeleaf结合,所以在html中需要引入
<html lang="en" xmlns:th="http://www.thymeleaf.org" xmlns:shiro="http://www.pollix.at/thymeleaf/shiro">
- shiro:hasPermission=“set:data:add” (单个权限控制)
<button shiro:hasPermission="set:data:add" type="button" class="btn btn-primary" onclick="add()">
<i class="fa fa-plus" aria-hidden="true"></i>添加
</button>
- shiro:hasAnyPermissions=“set:data:add,set:data:edit”(多个权限控制,“或”的关系)
<button shiro:hasAnyPermissions="set:data:add,set:data:edit" type="button" class="btn btn-primary" onclick="add()">
<i class="fa fa-plus" aria-hidden="true"></i>添加
</button>
- shiro:hasAllPermissions=“set:data:add,set:data:edit”(多个权限控制,“且”的关系)
<button shiro:hasAllPermissions="set:data:add,set:data:edit" type="button" class="btn btn-primary" onclick="add()">
<i class="fa fa-plus" aria-hidden="true"></i>添加
</button>
2、js
1、html设置默认初始是hidden,有权限才去掉hidden
<div>
<script type="text/javascript">
var h_edit = 'hidden';
var h_remove = 'hidden';
var h_detail = 'hidden';
</script>
</div>
<div shiro:hasPermission="set:data:edit">
<script type="text/javascript">
h_edit = '';
</script>
</div>
<div shiro:hasPermission="set:data:remove">
<script type="text/javascript">
h_remove = '';
</script>
</div>
<div shiro:hasPermission="set:data:detail">
<script type="text/javascript">
h_detail = '';
</script>
</div>
2、js中加入到class中
function(value, row, index) {
var e = '<a class="btn btn-primary btn-sm '+ h_edit +' " href="#" mce_href="#" title="编辑" onclick="edit(\''
+ row.dictCode
+ '\')"><i class="fa fa-edit">编辑</i></a> ';
var d = '<a class="btn btn-danger btn-sm '+ h_remove +'" href="#" title="删除" mce_href="#" onclick="remove(\''
+ row.dictCode
+ '\')"><i class="fa fa-remove">删除</i></a> ';
var f = '<a class="btn btn-success btn-sm '+ h_detail +'" href="#" title="展示" mce_href="#" onclick="show(\''
+ row.dictCode
+ '\')"><i class="fa fa-reorder">详情</i></a> ';
return e + d + f;
}