springMVC权限过滤器以及登录过滤器

最新推荐文章于 2024-11-13 17:17:25 发布

贤云（xianyun）

最新推荐文章于 2024-11-13 17:17:25 发布

阅读量557

点赞数

CC 4.0 BY-SA版权

分类专栏： springMVC 文章标签： java 测试

本文链接：https://blog.youkuaiyun.com/zhengun/article/details/84658596

springMVC 专栏收录该内容

3 篇文章

订阅专栏

本文详细介绍了Spring MVC框架中的权限过滤器和登录过滤器的实现方式，包括自动注入菜单项接口、处理未登录或越权访问的情况。

package com.zero2ipo.plugins.servlet;

import java.io.PrintWriter;
import java.util.List;

import javax.annotation.Resource;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.stereotype.Repository;
import org.springframework.web.servlet.HandlerInterceptor;
import org.springframework.web.servlet.ModelAndView;
import com.zero2ipo.plugins.menu.biz.IsysMenu;
import com.zero2ipo.plugins.menu.bo.SysMenu;
import com.zero2ipo.plugins.user.bo.User;

/**
 * @title springMVC权限过滤器以及登录过滤器
 * @author ZhengYunFei
 * @date 2014-9-29
 */
@Repository
public class SystemInterceptor implements HandlerInterceptor {
	//自动注入菜单项接口
	@Resource(name = "sysMenu")
	private IsysMenu sysMenu;
	@Override
	public boolean preHandle(HttpServletRequest request,
			HttpServletResponse response, Object handler) throws Exception {
		  HttpServletRequest req = (HttpServletRequest) request;
	      HttpServletResponse res = (HttpServletResponse) response;
	        String uri =  req.getRequestURI();
	        req.setAttribute("path", req.getContextPath());
	        //过滤器器中维护的特定url页面不进行拦截
	        if(!uri.matches("/c/login/userLogin")&&!uri.matches("/c/login/userLogout")){
	            //如果没有登陆，或者请求session超时都返回重新登陆 
	            User so = (User) req.getSession().getAttribute("user");
	            if(so == null || so.equals("")){
	                PrintWriter out = res.getWriter() ;
	                out.print("<html>") ;
	                out.print("<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />") ;
	                out.print("<script> ") ;   
	                out.print("window.top.location='/index.html?errorType=7';") ; 
	                out.print("</script>") ; 
	                out.print("</html>") ;
	                return false;
	            }else{
	            	//已经登录的用户，防止其越权，访问其没有权限的url
	            	//根据此登录用户的ID查询该用户所拥有的url权限
	            	String userId=so.getUserId();
	            	List<SysMenu> list=sysMenu.findMenuListByUserId(userId);
	            	System.out.println("访问的url="+uri);
	            	for(int i=0;i<list.size();i++){
	            		System.out.println("该用户拥有的url权限为："+list.get(i).getPathCode());
	            	}
	            	//判断uri是否存在list中，如果存在
	            	if(list.contains(uri)){
	            		return true;
	            	}else{
	            		PrintWriter out = res.getWriter() ;
	            		//非法操作,该用户试图访问无权限的uri
	 	                out.print("<html>") ;
	 	                out.print("<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />") ;
	 	                out.print("<script> ") ;   
	 	                out.print("window.top.location='/index.html?errorType=9';") ; 
	 	                out.print("</script>") ; 
	 	                out.print("</html>") ;
	            		return false;
	            	}
	            }
	         }
			return true;
	}

	@Override
	public void afterCompletion(HttpServletRequest arg0,
			HttpServletResponse arg1, Object arg2, Exception arg3)
			throws Exception {
		
	}

	@Override
	public void postHandle(HttpServletRequest arg0, HttpServletResponse arg1,
			Object arg2, ModelAndView arg3) throws Exception {
		
	}

}

spring-servlet.xml中配置

<!-- 权限过滤配置 -->
<mvc:annotation-driven/>
<mvc:interceptors>
   <mvc:interceptor>
       <mvc:mapping path="/**" />
       <bean class="com.zero2ipo.plugins.servlet.SystemInterceptor"/>
   </mvc:interceptor>
</mvc:interceptors>