day88---权限组件之权限限制

设计表结构(models.py)

	from django.db import models
	class UserInfo(models.Model):
		username = models.CharField(max_length=32, verbose_name='用户名')
		password = models.CharField(max_length=32, verbose_name='密码')
		name = models.CharField(max_length=32, null=True, verbose_name='用户姓名')
		age = models.IntegerField(null=True, verbose_name='年龄')
		email = models.EmailField(null=True, verbose_name='邮箱地址')
		telephone = models.BigIntegerField(null=True, verbose_name='手机号码')
		roles = models.ManyToManyField(to='Role', verbose_name='关联角色')
		def __str__(self):
			return '%s(%s)' % (self.name, self.username)
	class Role(models.Model):
		name = models.CharField(max_length=32, verbose_name='角色名')
		permissions = models.ManyToManyField(to='Permission', verbose_name='关联权限')
		def __str__(self):
			return self.name
	class Permission(models.Model):
		url = models.CharField(max_length=255, verbose_name='权限url地址')
		description = models.CharField(max_length=32, verbose_name='权限描述')
		def __str__(self):
			return self.description

配置Django_Admin(admin.py)

	from django.contrib import admin
	from .models import *
	class UserInfoConfig(admin.ModelAdmin):
		list_display = ['id', 'username', 'password', 'name', 'age', 'email', 'telephone']
		ordering = ['id']
	class RoleConfig(admin.ModelAdmin):
		list_display = ['id', 'name']
		ordering = ['id']
	class PermissionConfig(admin.ModelAdmin):
		list_display = ['id', 'url', 'description']
		ordering = ['id']
	admin.site.register(UserInfo, UserInfoConfig)
	admin.site.register(Role, RoleConfig)
	admin.site.register(Permission, PermissionConfig)

初始化数据(使用DjangoAdmin)

-- permission权限表
INSERT INTO "rbac_permission" VALUES (1, '/users/', '查看用户列表');
INSERT INTO "rbac_permission" VALUES (2, '/users/add/', '添加用户');
INSERT INTO "rbac_permission" VALUES (3, '/users/del/(\d+)', '删除用户');
INSERT INTO "rbac_permission" VALUES (4, '/users/edit/(\d+)', '编辑用户');
INSERT INTO "rbac_permission" VALUES (5, '/orders/', '查看订单列表');
INSERT INTO "rbac_permission" VALUES (6, '/orders/add/', '添加订单');
INSERT INTO "rbac_permission" VALUES (7, '/orders/del/(\d+)', '删除订单');
INSERT INTO "rbac_permission" VALUES (8, '/orders/edit/(\d+)', '编辑订单');
-- 
-- role角色表
INSERT INTO "rbac_role" VALUES (1, 'CEO');
INSERT INTO "rbac_role" VALUES (2, 'CHO');
INSERT INTO "rbac_role" VALUES (3, 'CTO');
INSERT INTO "rbac_role" VALUES (4, 'HR_Leader');
INSERT INTO "rbac_role" VALUES (5, 'IT_Leader');
INSERT INTO "rbac_role" VALUES (6, 'HR');
INSERT INTO "rbac_role" VALUES (7, 'IT');
--
-- userinfo用户表
INSERT INTO "rbac_userinfo" VALUES (1, 'liyan', '123456', '李岩', 18, 'liyan@liyan.com', 13888888888);
INSERT INTO "rbac_userinfo" VALUES (2, 'yy', '123456', '丫丫', 18, 'yy@yy.com', 13999999999);
INSERT INTO "rbac_userinfo" VALUES (3, 'yange', '123456', '岩哥', 22, 'yange@yange.com', 13666666666);
INSERT INTO "rbac_userinfo" VALUES (4, 'zhangsan', '123456', '张三', 28, 'zhangsan@zhangsan.com', 11111111111);
INSERT INTO "rbac_userinfo" VALUES (5, 'lisi', '123456', '李四', 29, 'lisi@lisi.com', 22222222222);
INSERT INTO "rbac_userinfo" VALUES (6, 'aaa', '123456', '用户aaa', 38, 'aaa@aaa.com', 1234567890);
INSERT INTO "rbac_userinfo" VALUES (7, 'bbb', '123456', '用户bbb', 39, 'bbb@bbb.com', 1234567890);
INSERT INTO "rbac_userinfo" VALUES (8, 'hr', '123456', 'HR老大', 26, 'hr@hr.com', 999999999);
INSERT INTO "rbac_userinfo" VALUES (9, 'it', '123456', 'IT老大', 26, 'it@it.com', 66666666666);
--
-- role_permissions角色与权限多对多关系表
INSERT INTO "rbac_role_permissions" VALUES (1, 1, 1);
INSERT INTO "rbac_role_permissions" VALUES (2, 1, 2);
INSERT INTO "rbac_role_permissions" VALUES (3, 1, 3);
INSERT INTO "rbac_role_permissions" VALUES (4, 1, 4);
INSERT INTO "rbac_role_permissions" VALUES (5, 1, 5);
INSERT INTO "rbac_role_permissions" VALUES (6, 1, 6);
INSERT INTO "rbac_role_permissions" VALUES (7, 1, 7);
INSERT INTO "rbac_role_permissions" VALUES (8, 1, 8);
INSERT INTO "rbac_role_permissions" VALUES (9, 2, 1);
INSERT INTO "rbac_role_permissions" VALUES (10, 2, 2);
INSERT INTO "rbac_role_permissions" VALUES (11, 2, 3);
INSERT INTO "rbac_role_permissions" VALUES (12, 2, 4);
INSERT INTO "rbac_role_permissions" VALUES (13, 3, 8);
INSERT INTO "rbac_role_permissions" VALUES (14, 3, 5);
INSERT INTO "rbac_role_permissions" VALUES (15, 3, 6);
INSERT INTO "rbac_role_permissions" VALUES (16, 3, 7);
INSERT INTO "rbac_role_permissions" VALUES (17, 4, 1);
INSERT INTO "rbac_role_permissions" VALUES (19, 4, 2);
INSERT INTO "rbac_role_permissions" VALUES (20, 4, 4);
INSERT INTO "rbac_role_permissions" VALUES (21, 5, 8);
INSERT INTO "rbac_role_permissions" VALUES (22, 5, 5);
INSERT INTO "rbac_role_permissions" VALUES (23, 5, 6);
INSERT INTO "rbac_role_permissions" VALUES (24, 6, 1);
INSERT INTO "rbac_role_permissions" VALUES (25, 7, 5);
--
-- userinfo_roles用户和角色多对多关系表
INSERT INTO "rbac_userinfo_roles" VALUES (1, 1, 1);
INSERT INTO "rbac_userinfo_roles" VALUES (2, 2, 2);
INSERT INTO "rbac_userinfo_roles" VALUES (3, 3, 3);
INSERT INTO "rbac_userinfo_roles" VALUES (4, 4, 4);
INSERT INTO "rbac_userinfo_roles" VALUES (5, 4, 6);
INSERT INTO "rbac_userinfo_roles" VALUES (6, 5, 5);
INSERT INTO "rbac_userinfo_roles" VALUES (7, 5, 7);
INSERT INTO "rbac_userinfo_roles" VALUES (8, 6, 6);
INSERT INTO "rbac_userinfo_roles" VALUES (9, 7, 7);
INSERT INTO "rbac_userinfo_roles" VALUES (10, 8, 2);
INSERT INTO "rbac_userinfo_roles" VALUES (11, 8, 4);
INSERT INTO "rbac_userinfo_roles" VALUES (12, 8, 6);
INSERT INTO "rbac_userinfo_roles" VALUES (13, 9, 3);
INSERT INTO "rbac_userinfo_roles" VALUES (14, 9, 5);
INSERT INTO "rbac_userinfo_roles" VALUES (15, 9, 7);

添加系统配置(settings.py)

    INSTALLED_APPS = [
        'rbac.apps.RbacConfig',
    ]
    MIDDLEWARE = [
        'rbac.services.middleware.login.LoginVerificationMiddleware',
    ]

配置路由系统(urls.py)

	from django.conf.urls import url
	from django.contrib import admin
	from quanxian import views
	urlpatterns = [
		url(r'^admin/', admin.site.urls),
		# 全局配置(不受中间件限制)
		url(r'^register/$', views.register),
		url(r'^login/$', views.log_in),
		url(r'^logout/$', views.log_out),
		url(r'^index/$', views.index),
		# 用户管理相关url
		url(r'^users/$', views.users),
		url(r'^users/add/$', views.users_add),
		url(r'^users/del/(\d+)$', views.users_del),
		url(r'^users/edit/(\d+)$', views.users_edit),
		# 订单管理相关url
		url(r'^orders/$', views.orders),
		url(r'^orders/add/$', views.orders_add),
		url(r'^orders/del/(\d+)$', views.orders_del),
		url(r'^orders/edit/(\d+)$', views.orders_edit),
	]

配置中间件(services/middleware/login.py)

	from django.shortcuts import redirect, HttpResponse
	from django.utils.deprecation import MiddlewareMixin
	import re
	class LoginVerificationMiddleware(MiddlewareMixin):
		def process_request(self, request):
			# 添加url白名单
			white_list = ['/register/.*', '/login/.*', '/logout/', '/index/', '/admin/.*']
			# 获取当前的url
			current_path = request.path
			# 判断当前的url是否在白名单中
			for i in write_list:
				ret = re.match(i, current_path)
				if ret:
					return None
			# 判断当前用户是否是已登录用户
			user_id = request.session.get('user_id')
			if not user_id:
				return redirect('/login/')
			# 判断当前用户对当前访问的url是否有权限
			permission_list = request.session.get('permission_list')
			for i in permission_list:
				i = '^%s$' % i
				ret = re.match(i, current_path)
				if ret:
					return None
			return HttpResponse('<h2><font color="red">没有权限</font></h2>')

配置session处理(services/session/permission.py)

    # 写入session操作，无需返回值
    def record_session(request, user):
        permission_info = user.roles.all().values('permissions__url',).distinct()
        permission_list = []
        for i in permission_info:
            permission_list.append(i['permissions__url'])
        request.session['permission_list'] = permission_list

在业务逻辑的应用中配置视图函数(views.py)

	from django.shortcuts import render, redirect, HttpResponse
	from rbac.models import *
	from rbac.services.session import permission
	def register(request):
		return redirect('/login/')
	def log_in(request):
		if request.method == 'POST':
			user = request.POST.get('user')
			pwd = request.POST.get('pwd')
			user_obj = UserInfo.objects.filter(username=user, password=pwd).first()
			# 判断当前用户登录是否成功(登录成功后跳转首页，否则跳转登录页面)
			if user_obj:
				# 把用户的登录信息写入session
				request.session['user_id'] = user_obj.id
				permission.record_session(request, user_obj)
				return redirect('/index/')
			else:
				return redirect('/login/')
		return render(request, 'login.html')
	def log_out(request):
		request.session.flush()
		return redirect('/login/')
	def index(request):
		user_id = request.session.get('user_id', None)
		if user_id:
			user_obj = UserInfo.objects.get(id=user_id)
		return render(request, 'index.html', locals())
	def users(request):
		return HttpResponse('<h1><font color="green">查看用户列表</font></h1>')
	def users_add(request):
		return HttpResponse('<h1><font color="green">添加用户</font></h1>')
	def users_del(request, *args):
		return HttpResponse('<h1><font color="green">删除用户</font></h1>')
	def users_edit(request, *args):
		return HttpResponse('<h1><font color="green">编辑用户</font></h1>')
	def orders(request):
		return HttpResponse('<h1><font color="blue">查看订单列表</font></h1>')
	def orders_add(request):
		return HttpResponse('<h1><font color="blue">添加订单</font></h1>')
	def orders_del(request, *args):
		return HttpResponse('<h1><font color="blue">删除订单</font></h1>')
	def orders_edit(request, *args):
		return HttpResponse('<h1><font color="blue">编辑订单</font></h1>')

配置模板系统-登录页面(login.html)

	<!DOCTYPE html>
	<html lang="en">
	<head>
		<meta charset="UTF-8">
		<meta http-equiv="X-UA-Compatible" content="IE=edge">
		<meta name="viewport" content="width=device-width, initial-scale=1">
		<link rel="stylesheet" href="https://cdn.bootcss.com/bootstrap/3.3.7/css/bootstrap.min.css">
		<script src="https://cdn.bootcss.com/jquery/3.3.1/jquery.js"></script>
		<script src="https://cdn.bootcss.com/bootstrap/3.3.7/js/bootstrap.min.js"></script>
		<title>登录页面</title>
	</head>
	<body>
	<div class="container">
		<div class="row">
			<div class="col-md-offset-3 col-md-8">
				<div class="page-header">
					<h1>
						登录页面
						<small>login</small>
					</h1>
				</div>
				<form class="form-horizontal" action="/login/" method="post" enctype="multipart/form-data">
					{% csrf_token %}
					<div class="form-group">
						<label for="user" class="col-md-2 control-label">用户名：</label>
						<div class="col-md-5">
							<input type="text" class="form-control" id="user" name="user" placeholder="用户名">
						</div>
					</div>
					<div class="form-group">
						<label for="pwd" class="col-md-2 control-label">密码：</label>
						<div class="col-md-5">
							<input type="password" class="form-control" id="pwd" name="pwd" placeholder="密码">
						</div>
					</div>
					<div class="form-group">
						<div class="col-md-offset-2 col-md-10">
							<div class="checkbox">
								<label>
									<input type="checkbox">记住我
								</label>
							</div>
						</div>
					</div>
					<p class="col-md-offset-3 err_msg"></p>
					<div class="form-group">
						<div class="col-md-offset-2 col-md-5">
							<input type="submit" id="login" class="btn btn-primary btn-block" value="登录">
						</div>
					</div>
				</form>
			</div>
		</div>
	</div>
	</body>
	</html>

配置模板系统-首页(index.html)

	<!DOCTYPE html>
	<html lang="en">
	<head>
		<meta charset="UTF-8">
		<meta http-equiv="X-UA-Compatible" content="IE=edge">
		<meta name="viewport" content="width=device-width, initial-scale=1">
		<link rel="stylesheet" href="https://cdn.bootcss.com/bootstrap/3.3.7/css/bootstrap.min.css">
		<script src="https://cdn.bootcss.com/jquery/3.3.1/jquery.js"></script>
		<script src="https://cdn.bootcss.com/bootstrap/3.3.7/js/bootstrap.min.js"></script>
		<title>首页</title>
	</head>
	<body>
	<div class="container">
		<div class="row">
			<div class="col-md-offset-3 col-md-5">
				<div class="page-header">
					<h1>
						首页
						<small>index</small>
					</h1>
				</div>
				{% if user_obj %}
					<div class="h4 text-primary">当前登录用户： <span class="h3 text-danger bg-danger">{{ user_obj.name }}</span>
						<a href="/logout/" class="btn btn-success pull-right">注销当前用户</a>
					</div>
					<hr>
					<div class="row">
						<a href="/users/" class="col-md-offset-1 btn btn-danger btn-lg">查看用户列表</a>
						<a href="/orders/" class="col-md-offset-3 btn btn-primary btn-lg">查看订单列表</a>
					</div>
					<br>
					<div class="row">
						<a href="/users/add/" class="col-md-offset-1 btn btn-danger btn-lg">添加用户操作</a>
						<a href="/orders/add/" class="col-md-offset-3 btn btn-primary btn-lg">添加订单操作</a>
					</div>
					<br>
					<div class="row">
						<a href="/users/del/{{ user_id }}" class="col-md-offset-1 btn btn-danger btn-lg">删除用户操作</a>
						<a href="/orders/del/{{ user_id }}" class="col-md-offset-3 btn btn-primary btn-lg">删除订单操作</a>
					</div>
					<br>
					<div class="row">
						<a href="/users/edit/{{ user_id }}" class="col-md-offset-1 btn btn-danger btn-lg">编辑用户操作</a>
						<a href="/orders/edit/{{ user_id }}" class="col-md-offset-3 btn btn-primary btn-lg">编辑订单操作</a>
					</div>
				{% else %}
					<div class="h4 text-primary">未登陆用户
						<a href="/login/" class="col-md-offset-2 btn btn-success">点击登录</a>
					</div>
				{% endif %}
			</div>
		</div>
	</div>
	</body>
	</html>

posted @ 2018-03-08 20:52 _岩哥阅读(72) 评论(0) 收藏举报

刷新页面返回顶部

世上无难事，只怕有心人

不积跬步，无以至千里；不积小流，无以成江海

day88---权限组件之权限限制

设计表结构(models.py)

配置Django_Admin(admin.py)

初始化数据(使用DjangoAdmin)

添加系统配置(settings.py)

配置路由系统(urls.py)

配置中间件(services/middleware/login.py)

配置session处理(services/session/permission.py)

在业务逻辑的应用中配置视图函数(views.py)

配置模板系统-登录页面(login.html)

配置模板系统-首页(index.html)

公告