用拦截器,注解实现权限

拦截器

package cn.itcast.crm.interceptor;

import java.lang.reflect.Method;
import java.util.List;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpSession;

import org.apache.struts2.ServletActionContext;

import cn.itcast.crm.annotation.Limit;
import cn.itcast.crm.container.ServiceProvinder;
import cn.itcast.crm.domain.SysPopedomPrivilege;
import cn.itcast.crm.domain.SysUser;
import cn.itcast.crm.service.ISysPopedomPrivilegeService;
import cn.itcast.crm.util.SessionUtils;

import com.opensymphony.xwork2.ActionContext;
import com.opensymphony.xwork2.ActionInvocation;
import com.opensymphony.xwork2.interceptor.MethodFilterInterceptor;

public class LimitInterceptor extends MethodFilterInterceptor{

	@Override
	protected String doIntercept(ActionInvocation invocation) throws Exception {
		Object action = invocation.getAction(); //获得action
		String methodName = invocation.getProxy().getMethod(); //通过action代理获得方法名
		Method method = action.getClass().getMethod(methodName, null);
		HttpServletRequest httpServletRequest = ServletActionContext.getRequest();
		boolean flag = isCheckLimit(httpServletRequest,method); //检查该用户是否有此方法权限
		if (!flag) {
			System.out.println("没有权限");
			return "popmsg_popedom";
		}
		String result = invocation.invoke();  //继续下一个拦截器或者执行action
		return result;
	}

	private boolean isCheckLimit(HttpServletRequest httpServletRequest,
			Method method) {
		if (method==null) {
			return false;
		}
		SysUser sysUser = SessionUtils.getSysUserFormSession(httpServletRequest);
		if (sysUser==null) {
			return false;
		}
		if (sysUser.getSysRole()==null) {
			return false;
		}
		String roleId=sysUser.getSysRole().getId();
		boolean isAnnotationPresent = method.isAnnotationPresent(Limit.class); //此方法是否有注解limit
		if (!isAnnotationPresent) {
			return false;
		}
		Limit limit = method.getAnnotation(Limit.class); //获得该方法上的limit注解
		String privilege = limit.privilege();
		String module = limit.module();
		boolean flag = false; //查看该roleId的权限里面是否有注解的方法，有则有权限
		ISysPopedomPrivilegeService sysPopedomPrivilegeService = (ISysPopedomPrivilegeService) new ServiceProvinder().getBean(ISysPopedomPrivilegeService.SERVICE_NAME);
		List<SysPopedomPrivilege> sysPopedomPrivileges = sysPopedomPrivilegeService.findAllSysPopedomPrivileges();
		if (sysPopedomPrivileges!=null && sysPopedomPrivileges.size()!=0) {
			for(SysPopedomPrivilege sysPopedomPrivilege :sysPopedomPrivileges)
				if (roleId.equals(sysPopedomPrivilege.getId().getRoleId())
						&&privilege.equals(sysPopedomPrivilege.getId().getPopedomPrivilege())
						&&module.equals(sysPopedomPrivilege.getId().getPopedomModule())) {
					flag = true;
					break;
				}
		}
		return flag;
	}

}

limit注解

package cn.itcast.crm.annotation;

import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;

@Retention(RetentionPolicy.RUNTIME)
public @interface Limit {
	String module();  //模块名称
	 String privilege(); //操作名称
}

定义拦截器栈

<package name="default" extends="struts-default" namespace="/sys">
	<interceptors>
  <interceptor name="limitInterceptor" class="cn.itcast.crm.interceptor.LimitInterceptor"/>
  <interceptor-stack name="limitStack">
    <interceptor-ref name="defaultStack"/>
    <interceptor-ref name="limitInterceptor">
      <param name="excludeMethods">isLogin,top,left</param>
    </interceptor-ref>
  </interceptor-stack>
</interceptors>
 <default-interceptor-ref name="limitStack"/>
 <global-results>
		<result name="popmsg_popedom">/WEB-INF/jsp/page/popmsg_popedom.jsp</result>
	</global-results>

注解应用

@Limit(module="user",privilege="list")
public String list()