权限过滤器

1.web.xml 文件配置
<?xml version="1.0" encoding="UTF-8"?>
<web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee 
http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">
<filter-name>PermissionFilter</filter-name>
<filter-class>com.filter.PermissionFilter</filter-class>
<init-param>
<param-name>arrLogin</param-name>
<param-value>login.jsp;login!login.action</param-value>
</init-param>
<init-param>
<param-name>arrFrame</param-name>
<param-value>test!test.action</param-value>
</init-param>
<init-param>
<param-name>arrPortal</param-name>
<param-value>index.jsp;exceptions;</param-value>
</init-param>
<init-param>
<param-name>noSession</param-name>
<param-value>/exceptions/errorinfo.jsp?ERROR_CODE=1</param-value>
</init-param>
<init-param>
<param-name>noPermission</param-name>
<param-value>/exceptions/errorinfo.jsp?ERROR_CODE=2</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>PermissionFilter</filter-name>
<url-pattern>*.action</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>PermissionFilter</filter-name>
<url-pattern>*.jsp</url-pattern>
</filter-mapping>

<welcome-file-list>
<welcome-file>login.jsp</welcome-file>
</welcome-file-list>
</web-app>
2.根据 菜单权限查询角色
public class Permission extends HibernateDaoSupport
{
    /**
     *JDBC操作模板
     */
    protected JdbcTemplate jdbcTemplate;
    private Map permisstionMap = new HashMap() ;
    public void loadPermissions(){
      //加载菜单所对应的权限
      String sql ="select t.node_url,r.role_id from tb_trees_menus t, tb_roles_trees r where "
              +" t.node_id = r.node_id  and t.node_url is not null and t.node_url <>'' "
              +"group by t.node_url,r.role_id ";
      List list = this.jdbcTemplate.queryForList(sql);
      Map map = new HashMap();
      for(int i=0;i<list.size();i++){
          Map node = (Map) list.get(i);
          map.put(node.get("node_url"), node.get("role_id"));
      }
      this.permisstionMap = map;
    }
    public Map getPermisstionMap() {
        return permisstionMap;
    }
    public void setPermisstionMap(Map permisstionMap)
    {
        this.permisstionMap = permisstionMap;
    }
}
3.过滤处理
public class PermissionFilter implements Filter {
    // 允许访问的资源
    private String[] arrLogin, arrFrame, arrPortal;
    //会话失效
    private String  noSession ;
    //没权限
    private String noPermission;
    //日志记录器
    private Logger log = Logger.getLogger(PermissionFilter.class);
    public void destroy() {
    }
    @SuppressWarnings("deprecation")
    public void doFilter(ServletRequest arg0, ServletResponse arg1,
            FilterChain arg2) throws IOException, ServletException {
        HttpServletRequest request = (HttpServletRequest) arg0;
        HttpServletResponse response = (HttpServletResponse) arg1;
        UserInfo user = (UserInfo) request.getSession().getAttribute("user");
        String requestUrl = request.getRequestURI();
        if(user==null){
            user = (UserInfo) request.getSession().getAttribute("user");
        }
        String request_ip = request.getLocalAddr();
        String contextPath = request.getContextPath();
        /**
         * 如果处理HTTP请求，并且需要访问诸如getHeader或getCookies等在ServletRequest中
         * 无法得到的方法，就要把此request对象构造成HttpServletRequest
         */
        if(user==null){
            if(!requestUrl.equals(Constants.WEBROOT)&&!isContains(requestUrl, arrLogin))
            {
                request.getRequestDispatcher(noSession).forward(request, response);
                return;
            }
        }else if(requestUrl.indexOf(".action")!=-1&&requestUrl.length()>Constants.WEBROOT.length())
        {
            String role_ids = user.getRoleIds();
            String realURI = requestUrl.substring(Constants.WEBROOT.length());
            if(!hasPermission(role_ids, realURI)){
                request.getRequestDispatcher(noSession).forward(request, response);
                return ;
            }
        }else if(requestUrl.indexOf(".jsp")!=-1&&requestUrl.length()>Constants.WEBROOT.length())
        {
            String role_ids = user.getRoleIds();
            String realURI = requestUrl.substring(Constants.WEBROOT.length());
            if(!hasPermission(role_ids, realURI)){
                request.getRequestDispatcher(noSession).forward(request, response);
                return ;
            }
        }
        response.addHeader("P3P", "CP=CAO PSA OUR");
        arg2.doFilter(arg0, arg1);
    }
    /**
    /*加载web.xml文件中配置信息
    /*
    public void init(FilterConfig config) throws ServletException {
        String arrLogins = config.getInitParameter("arrLogin");
        if(arrLogins!=null){
            this.arrLogin = arrLogins.split(";");
        }else{
            this.arrLogin = new String[0];
        }
        String arrFrames = config.getInitParameter("arrFrame");
        if(arrLogins!=null){
            this.arrFrame = arrFrames.split(";");
        }else{
            this.arrFrame = new String[0];
        }
        String arrPortals = config.getInitParameter("arrPortal");
        if(arrLogins!=null){
            this.arrPortal = arrPortals.split(";");
        }else{
            this.arrPortal = new String[0];
        }
        this.noSession = config.getInitParameter("noSession");
        this.noPermission = config.getInitParameter("noPermission");
    }
    public boolean isContains(String requestUrl,String regx[]){
        boolean result = false;
        for(int i=0;i<regx.length;i++){
            if(requestUrl.indexOf(regx[i])!=-1){
                result = true;
                break;
            }
        }
        return result;
    }

    /**
    /* 判断角色权限
    /*
    public boolean hasPermission(String roles,String node_url){
        boolean result = false;
        Permission ps = new Permission();
        Map permissionMap = ps.getPermisstionMap();                               //数据库中获取菜单权限的角色信息
        String url_role_ids = (String) permissionMap.get(node_url);         //当前用户的权限信息
        String user_role_ids = roles;
        if(url_role_ids==null){
            return true;
        }
        String[] arr_url_role = url_role_ids.split(",");
        String[] arr_user_role = user_role_ids.split(",");
        for(int i=0;i<arr_url_role.length;i++){
            for(int j=0;j<arr_user_role.length;j++){
                if(arr_url_role[i].equals(arr_user_role[j])){
                    return true;
                }
            }
        }
        return result;
    }
}