django-中间件
1.中间件的基本编写格式
from django.conf import settings from django.shortcuts import redirect class MiddlewareMixin(object): def __init__(self, get_response=None): self.get_response = get_response super(MiddlewareMixin, self).__init__() def __call__(self, request): response = None if hasattr(self, 'process_request'): response = self.process_request(request) if not response: response = self.get_response(request) if hasattr(self, 'process_response'): response = self.process_response(request, response) return response class M1(MiddlewareMixin): def process_request(self,request,*args,**kwargs): # 如果当前的URL是 /login/ ，那就跳过该中间件的process_request方法 # /login/?name=xxx # /login/ if request.path_info == '/login/': return None # 排除/login/以外的所有URL，对用户认证。 user_info = request.session.get(settings.USER_SESSION_KEY) if not user_info: # 未登陆 return redirect('/login/') # 已登陆 def process_response(self, request, response): print('m1.process_response') return response
2.使用
在settings中配置
3.基于中间件的登录验证
3.1 编写中间件
import re from django.shortcuts import redirect,HttpResponse from django.conf import settings class MiddlewareMixin(object): def __init__(self, get_response=None): self.get_response = get_response super(MiddlewareMixin, self).__init__() def __call__(self, request): response = None if hasattr(self, 'process_request'): response = self.process_request(request) if not response: response = self.get_response(request) if hasattr(self, 'process_response'): response = self.process_response(request, response) return response class RbacMiddleware(MiddlewareMixin): def process_request(self,request): # 1. 获取当前请求的URL # request.path_info # 2. 获取Session中保存当前用户的权限 # request.session.get("permission_url_list') # 获取当前的url请求 current_url = request.path_info # 当前请求的URL # 当前请求不需要执行权限验证 白名单机制 for url in settings.WHITE_LIST: if re.match(url,current_url): return None """ { 1:{ codes: [list,add,edit,del], urls: [ /userinfo/, /userinfo/add/, /userinfo/... ] }, 2:{ codes: [list,add,edit,del], urls: [ /userinfo/, /userinfo/add/, /userinfo/... ] } 3:{ codes: [list,add,edit,del], urls: [ /userinfo/, /userinfo/add/, /userinfo/... ] } } """ # 获取Session中保存当前用户的权限， permission_dict = request.session.get(settings.PERMISSION_URL_DICT_KEY) # 判断是否有权限，无权限则跳转到登录页面 if not permission_dict: return redirect('/rbac/login/') flag = False for group_id,code_url in permission_dict.items(): for db_url in code_url['urls']: regax = "^{0}$".format(db_url) # match只要是..开头的都能匹配到，多以的加个^和$符 if re.match(regax, current_url): # 获取当前用户对当前组内的所有code，并赋值给request request.permission_code_list = code_url['codes'] flag = True break if flag: break if not flag: return HttpResponse('无权访问')
3.2 在setting的MIDDLEWARE是中配置
MIDDLEWARE = [ ... 'django.middleware.clickjacking.XFrameOptionsMiddleware', 'rbac.middlewares.rbac.RbacMiddleware', ]
3.3 对登录信息保存session中
from django.conf import settings def init_permission(user,request): """ 初始化权限信息，获取权限信息并放置到session中。 :param user: :param request: :return: """ permission_list = user.roles.filter(permissions__id__isnull=False).values( 'permissions__id', 'permissions__title', # 用户列表 'permissions__url', # 含正则表达式的url 'permissions__code', # 权限代码【list,add,del,edit】 'permissions__menu_gp_id', # 组内菜单ID，Null表示是菜单 'permissions__group_id', # 权限的组ID 'permissions__group__menu_id', # 权限的组的菜单ID 'permissions__group__menu__title', # 权限的组的菜单名称 ).distinct() # 菜单相关（以后再匹配）,inclusion_tag，对菜单进行重新设置 menu_permission_list = [] for item in permission_list: tpl = { 'id':item['permissions__id'], # 权限ID 'title':item['permissions__title'], # 权限标题 'url':item['permissions__url'], # 含正则表达式的url 'menu_gp_id':item['permissions__menu_gp_id'], # 菜组内菜单ID，Null表示是菜单 'menu_id':item['permissions__group__menu_id'], # 权限的组的菜单ID 'menu_title':item['permissions__group__menu__title'], # 权限组的菜单名称 } menu_permission_list.append(tpl) request.session[settings.PERMISSION_MENU_KEY] = menu_permission_list # 权限相关，中间件 """ { 1:{ codes: [list,add,edit,del], urls: [ /userinfo/, /userinfo/add/, /userinfo/... ] }, 2:{ codes: [list,add,edit,del], urls: [ /userinfo/, /userinfo/add/, /userinfo/... ] } 3:{ codes: [list,add,edit,del], urls: [ /userinfo/, /userinfo/add/, /userinfo/... ] } } """ result = {} for item in permission_list: group_id = item['permissions__group_id'] # 权限的组ID code = item['permissions__code'] # 权限代码【list,add,del,edit】 url = item['permissions__url'] # 含正则表达式的url if group_id in result: result[group_id]['codes'].append(code) result[group_id]['urls'].append(url) else: result[group_id] = { 'codes':[code,], 'urls':[url,] } request.session[settings.PERMISSION_URL_DICT_KEY] = result
3.4 配置url的白名单机制
# rbac相关配置 PERMISSION_MENU_KEY = "permission_menu_list" PERMISSION_URL_DICT_KEY = "permission_url_list" # ===白名单（不需要权限就可以看到的） WHITE_LIST= [ '^/index/', '^/rbac/login/', '^/rbac/get_valid_img/', '^/logout/', "^/admin*", ]
