erp权限管理jsp

<%@page contentType="text/html;charset=big5"%>
<%@page import="java.sql.*" %>
<%@page import="java.io.*" %>
<%@page import="java.util.*" %>
<%@page import="java.text.*" %>
<jsp:useBean id="DBconn" scope="page" class="com.connection" />
<jsp:useBean id="DBconn1" scope="page" class="com.connection" />
<%@include file="/inc/strRequest.jsp" %>
<%

 String App_ID=str(request.getParameter("App_ID"));
 if(App_ID.equals(""))
 App_ID=str((String)session.getAttribute("App_ID"));
 
 session.setAttribute("App_ID",App_ID);
String CurrentPage="";
%>
<%@include file="/inc/security.jsp"%>
<%	
	Connection conn = null;
	java.sql.Statement  stmt = null;
	java.sql.Statement  stmt1 = null;	
	java.sql.Statement stmt2 = null;
	ResultSet  rs   = null;
	ResultSet  RS   = null;
	conn= DBconn.getConnection();
	stmt= conn.createStatement();
	stmt1= conn.createStatement();
	stmt2 = conn.createStatement();
	String sqlApp = "";
	String powerstr="";
	String group="";
	String sql="";
	String query="";
	String user="";
	String Flag="";
	String SubmitFlag="";
	
	  Flag=request.getParameter("Flag");
	  //out.print("Flag="+Flag+"<br>");
	  SubmitFlag=str(request.getParameter("s"));
	  //out.print("ff="+SubmitFlag+"<br>");
	
	//submit
	if(request.getParameter("s")!=null&&request.getParameter("s")!="")
	{
		if(request.getParameterValues("power")!=null)
		{	powerstr="";
			user = request.getParameter("user");	
			String[] power;							
			power = request.getParameterValues("power");
			RS= stmt.executeQuery("select  App_ID from tApplication");
			while(RS.next()){
				String currentAppID=str(RS.getString("App_ID"));
		     		for(int m=0;m<power.length;m++){	
				     if(currentAppID.equals(str(power[m]))){	
					   sqlApp = "select Urr_RightID from tUserRight where Urr_RightID='"+currentAppID+"' and Urr_UserID='"+user+"'";
				       rs=stmt1.executeQuery(sqlApp);
				          if(!rs.next()){
				             powerstr="insert tUserRight (Urr_UserID,Urr_RightID,Urr_Right) values('"+user+"','"+currentAppID+"','t')";
				            //out.print(powerstr);
				          }else
					         powerstr="update tUserRight set Urr_Right='t' where Urr_UserID='"+user+"' and Urr_RightID='"+currentAppID+"'";
					        //out.print(powerstr);
					       break;
					}else
					   powerstr="update tUserRight set Urr_Right='f' where Urr_UserID='"+user+"' and Urr_RightID='"+currentAppID+"'";
					}		
				//out.print("powerstr="+powerstr+"<br>");		
			stmt2.executeUpdate(powerstr);
			}
			//stmt.executeUpdate(powerstr);
			//out.print(powerstr);
			}
	}	
	//display the all group
	String groupStr="";
	group=str(request.getParameter("group"));
     //out.print("group="+group);
	 if(!SubmitFlag.equals("")){
	   group="";
	 }
	RS=stmt1.executeQuery("select * from tGroup order by Grp_Name");
	while(RS.next()){
	if(RS.getString("Grp_ID").equals(group))
	groupStr+="<option value='"+RS.getInt("Grp_ID")+"' selected>"+RS.getString("Grp_Name")+"</option>";
	else
	groupStr+="<option value='"+RS.getInt("Grp_ID")+"'>"+RS.getString("Grp_Name")+"</option>";
	}
	//display the all power
	String powerStr = "<tr>";
	String powerName= "";
	String ServiceStr="";
	int vApp_ID=0;
	rs=stmt.executeQuery("select * from tApplication order by App_MenuIndex asc,App_Index asc");
	int j = 0;
		//display the group power
		RS=stmt1.executeQuery("select * from tGroupRight ");
		if(RS.next())
		ServiceStr=RS.getString("Grr_Right");
			while(rs.next()){
	if(str(rs.getString("App_Parent")).equals("0")){
			powerStr +="</tr><td colspan=6 align=center><hr width='100%' size='1' noshade></td><tr>";
			j=0;
			}
		j++;
		vApp_ID = rs.getInt("App_ID");
		powerName = strrequest(rs.getString("App_Description"));
		StringTokenizer ts = new StringTokenizer(ServiceStr,":");
		int n = ts.countTokens();
		
		String tempMenu =str(rs.getString("App_Menu")).toUpperCase();
			if(j>1 && tempMenu.equals("T")){
		powerStr +="</tr><tr><td> </td>";
		 powerName="<font color=green>"+powerName+"</font>";
		j=1;
		}
		if(j==1&& tempMenu.equals("T")) powerName="<font color=red>"+powerName+"</font>";//if it is menu then red display
		
		while(ts.hasMoreTokens()){
			n--;
			int rights = Integer.parseInt(ts.nextToken());
			if (rights==vApp_ID){
			   powerStr +="<td><input type=checkbox name=power value=\""+vApp_ID+"\" checked>"+powerName+"</td>";
			   n--;
			   break;
			}
		}
		if(n==ts.countTokens()){		
		powerStr +="<td><input type=checkbox name=power value=\""+vApp_ID+"\">"+powerName+"</td>";
		}			    			
		if(j%6==0){
	 		powerStr +="</tr><tr><td colspan=2> </td>";
			j=1;
	 	}
			
	}
	
	//display all user
	String userStr="";
		user=str(request.getParameter("user"));
		if(user.equals("")||user == null) user ="0";

	RS=stmt1.executeQuery("select * from tUser order by Usr_UsrID");
	while(RS.next()){
		if(str(RS.getString("Usr_ID")).equals(user))
	{

	userStr+="<option value='"+RS.getInt("Usr_ID")+"' selected>"+RS.getString("Usr_UsrID")+"</option>";
	}
	else
	userStr+="<option value='"+RS.getInt("Usr_ID")+"'>"+RS.getString("Usr_UsrID")+"</option>";
	}
	
	//display user power
	String userlist="";
	if(group.equals(""))
	{powerStr="";
	
	RS=stmt1.executeQuery("select * from tUserRight where Urr_UserID='"+user+"' and Urr_Right='t'");
	while(RS.next())	
		userlist+=str(RS.getString("Urr_RightID"))+":";
		
     rs=stmt.executeQuery("select * from tApplication order by App_MenuIndex asc,App_Index asc" );
	 
	if(userlist.length()>1)
	userlist=userlist.substring(0,userlist.length()-1);
	//out.print("userlist:"+userlist);
	j=0;
	while(rs.next()){
	if(str(rs.getString("App_Parent")).equals("0")){
			powerStr +="</tr><td colspan=7 align=center><hr width='100%' size='1' noshade></td><tr>";
			j=0;
			}
		j++;
		vApp_ID = rs.getInt("App_ID");
		powerName = strrequest(rs.getString("App_Description"));
		String tempMenu =str(rs.getString("App_Menu")).toUpperCase();
		StringTokenizer ts1 = new StringTokenizer(userlist,":");
		int n1 = ts1.countTokens();
		//add 7.25 by kairwen
		if(j>1 && tempMenu.equals("T")){
		powerStr +="</tr><tr><td> </td>";
		 powerName="<font color=green>"+powerName+"</font>";
		j=1;
		}
if(j==1&& tempMenu.equals("T")) powerName="<font color=red>"+powerName+"</font>";//if it is menu then red display
		
		while(ts1.hasMoreTokens()){
					n1--;
			int rights1 = Integer.parseInt(ts1.nextToken());
			if (rights1==vApp_ID){
			   powerStr +="<td><input type=checkbox name=power value=\""+vApp_ID+"\" checked>"+powerName+"</td>";
			   n1--;
			   break;
			}
		}
		if(n1==ts1.countTokens()){		
		powerStr +="<td><input type=checkbox name=power value=\""+vApp_ID+"\">"+powerName+"</td>";
		}	
		
		
			    			
	if(j%6==0){
	 		powerStr +="</tr><tr><td colspan=2> </td>";
					j=1;
	 	}
		
	}

	}	
%>
<html>
	<head>
		<title>Power of Group</title>
		<meta http-equiv="Content-Type" content="text/html; charset=big5">
		<script language="JavaScript">
		<!--
		function check(){
			if(document.form1.group.value=="" || document.form1.group.value==null)
		   {
			   alert("Please select the group!");			   
			   return false;			   			   
		   }
		  
	       return true;
		}
		function cfilter(){	
	        document.mainform.submit();		
       }
		function cfilter1(){
		    document.mainform.Flag.value="Yes";
	        document.mainform.submit();
					
       }
		-->	
		</script>
	
<link href="/inc/style.css" rel="stylesheet" type="text/css">
</head>
	
<body>
<span class="td8">您當前的位置:<img name="meun_r2_c7" src="../top/arrow.gif" border="0"><a href="/blank.jsp">首頁</a><img name="meun_r2_c7" src="../top/arrow.gif" border="0">權限管理<img name="meun_r2_c7" src="../top/arrow.gif" border="0">用戶權限        用戶:<%=strrequest((String)session.getAttribute("user"))%> </span> 
<form  name=mainform method="post" action="userpower.jsp" >
  <table width="100%" border="0">
    <tr class="td7"> 
      <td height="34" colspan="3"><strong>user ID</strong> 
        <select name="user" class="td7" onChange="cfilter()">
          <option value="">---please select user---</option>
          <%=userStr%> 
        </select>
      </td>
      <td height="34" colspan="4"><strong>group </strong> 
        <select name="group" class="td7" onChange="cfilter1()">
          <option value="" selected>---please select group---</option>
          <%=groupStr%> 
        </select>
      </td>
    </tr>
    <tr bgcolor="CCE7F3" class="td7"> 
      <td width="25%"><strong>Menu List</strong></td>
      <td width="15%"> </td>
      <td width="15%"> </td>
      <td width="15%" bgcolor="CCE7F3"> </td>
      <td width="15%"> </td>
      <td width="15%"> </td>
      <td width="15%"> </td>
    </tr>
    
    <%=powerStr%> 
	<tr bgcolor="#E3F1C7"> 
      <td colspan="7" align="center"><div align="left">說明:<br>紅色字体為主菜單<br>
        綠色字体為子菜單<br>
        黑色字体為子權限
        <p>如果要給某用戶子菜單權限,必須同時給予相應主菜單權限<br>
同理如果要給某用戶子權限,必須同時給予相應子菜單(如果有的話)和主菜單權限<br>
        </p>
        </div>
      </td>
    </tr>
    <tr bgcolor="#E3F1C7"> 
      <td colspan="7" align="center"> 
        <input name="s" type="submit" class="td7" value="submit">
		<input type="hidden" name="Flag" value="No">
      </td>
    </tr>
  </table>  
</form>
</body>
</html>
<%
	try{
		DBconn.close();
		DBconn1.close();
	}catch (Exception E){}
%>