做网站选云服务器内核,大连建设网站制作,js做网站,友情链接有用吗1、权限组件rbac 1、什么是权限 1 项目与应用 2 什么是权限#xff1f; 一个包含正则表达式url就是一个权限 who what how ----------True or Flase 2、版本1#xff1a;用户表与权限url表 对应关系 # 版本1UserInforname pwdpermissionmodels.manytomany(Permissi…1、权限组件rbac 1、什么是权限 1 项目与应用 2 什么是权限 一个包含正则表达式url就是一个权限 who what how ----------True or Flase   2、版本1用户表与权限url表 对应关系 # 版本1UserInforname pwdpermissionmodels.manytomany(Permission)name pwd egon 123 alex 456 A 111B 222C 333D 444Permissionurl.....title....id url title1 /users/ 查看用户2 /users/add/ 添加用户3 /customer/add 添加客户UserInfor_permissioniduser_idpermission_id id user_id permission_id1 1 1 2 1 23 2 24 3 15 3 26 3 34 4 15 4 26 4 34 5 15 5 26 5 34 6 15 6 26 6 34 7 15 7 26 7 3     示例登录人egon访问url:http://127.0.0.1:8000/users/ def users(request):user_idrequest.session.get(user_id)objUserInfor.objects.filter(pkuser_id).first()obj.permission.all().valuelist(url)return HttpResponse(users.....)   3、版本2 用户--》角色--》权限 UserInforname pwdrolesname pwd egon 123 alex 456 alex 456 alex 456 alex 456 alex 456 alex 456 alex 456 alex 456 Roletitle....... permissions......id title1 销售员UserInfor2Roleid user_id role_id 1 1 1Permissionurl.....title....id url title1 /users/ 查看用户2 /users/add/ 添加用户3 /customer/add 添加客户Role2Permissionid role_id permission_id 1 1 12 1 23 1 33 rbacrole-based access control   2、代码实现 1项目目录结构 2数据库表 from django.db import models# Create your models here.class User(models.Model):name models.CharField(max_length32)pwd models.CharField(max_length32)roles models.ManyToManyField(toRole)def __str__(self):return self.nameclass Role(models.Model):title models.CharField(max_length32)permissions models.ManyToManyField(toPermission)def __str__(self):return self.titleclass Permission(models.Model):title models.CharField(max_length32)url models.CharField(max_length32)def __str__(self):return self.title    3admin添加数据 创建超级用户 alex    注册数据表   from django.contrib import admin# Register your models here.from .models import *admin.site.register(User) admin.site.register(Role) admin.site.register(Permission)      3、登录验证 1、session中注册用户权限 1.在session中注册用户ID request.session[user_id] user.pk2.初始化 permission_list 并注册到session 中 initial_session(user,request) 注意点 permission user.roles.all().values(permission__url).distinct() 1.values: temp [] for role in user.roles.all(): # QuerySet[ Role: 保洁 , Role: 销售 ] temp.append({ title:role.title permission__url: role.permission__url.all() }) return temp2.values 不会去重 QuerySet [{title: 保洁, permission__url: /users/}, {title: 销售, permission__url: /users/}, {title: 销售, permission__url: /users/add}] 2、解耦     def initial_session(request,user):permissions user.roles.all().values(permissions__url).distinct()permission_list []for item in permissions:permission_list.append(item[permissions__url])print(permission_list) # [/users/, /users/add, /users/delete/(\\d), /users/edit/(\\d)] request.session[permission_list] permission_listvalues :for role in user.roles.all(): # QuerySet [Role: 保洁, Role: 销售]temp.append({title:role.title,permissions_url:role.permissions.all()})# QuerySet [{title: 保洁, permissions__url: /users/},# {title: 销售, permissions__url: /users/},# {title: 销售, permissions__url: /users/add}]         4、基于中间件的权限校验 1、middleware如何构造抄袭         2、正则匹配 from django.test import TestCase# Create your tests here.# 当前path 如何与 paths匹配 # 不能用in /users/delete/9 # 正则匹配 li [/users/, /users/add, /users/delete/(\\d), /users/edit/(\\d)]c_path /users/delete/9import reflag Falsefor permission in li:permission ^%s$ % permissionret re.match(permission, c_path)if ret:flag Truebreakif flag:print(success)# ret re.match(/users/, /users/delete/9) ret re.match(^/users/$, /users/delete/9) print(ret)     3、admin如何验证302重定向      3、构建中间件   # -*- coding: utf-8 -*- # Time : 2018/08/11 0011 9:04 # Author : Venicidimport refrom django.utils.deprecation import MiddlewareMixin from django.shortcuts import HttpResponse, redirectclass ValidPermission(MiddlewareMixin):def process_request(self, request):# 当前访问路径current_path request.path_info# 1、检验是否属于白名单 白名单不需要任何权限的url# 正则匹配valid_url_list [/login/,/reg/,/admin/.*]for valid_url in valid_url_list:ret re.match(valid_url, current_path)if ret:return None# 2、校验是否登录user_id request.session.get(user_id)if not user_id:return redirect(/login/)# 3、校验权限permission_list request.session.get(permission_list,[])flag Falsefor permission in permission_list:permission ^%s$ % permissionret re.match(permission, current_path)if ret:flag Truebreakif not flag:return HttpResponse(没有访问权限)return None    4、views视图url   url from django.contrib import admin from django.urls import path,re_pathfrom app01 import viewsurlpatterns [path(admin/, admin.site.urls),re_path(r^users/$,views.users),re_path(r^users/add/$,views.add_user),re_path(r^roles/$,views.roles),re_path(r^login/$,views.login), ]   views from django.shortcuts import render, HttpResponse# Create your views here.from rbac.models import *def users(request):user_list User.objects.all()return render(request, users.html, locals())def add_user(request):permission_list request.session[permission_list] # # [/users/, /users/add, /users/delete/(\\d), /users/edit/(\\d)]current_path request.path_infoflag Falsefor permission in permission_list:permission ^%s$%permissionret re.match(permission, current_path)if ret:flag Truebreakif not flag:return HttpResponse(没有访问权限)return HttpResponse(add user)def roles(request):role_list Role.objects.all()print(role_list)# 方式2 middleware# 方式1permission_list request.session[permission_list] # # [/users/, /users/add, /users/delete/(\\d), /users/edit/(\\d)]current_path request.path_infoflag Falsefor permission in permission_list:permission ^%s$%permissionret re.match(permission, current_path)if ret:flag Truebreakif not flag:return HttpResponse(没有访问权限)return render(request, roles.html, locals())from rbac.service.perssions import * def login(request):if request.method POST:user request.POST.get(user)pwd request.POST.get(pwd)user User.objects.filter(nameuser, pwdpwd).first()if user:############## 在session中注册用户request.session[user_id] user.pk############# 在session中注册权限list# 查询当前登录用户的所有角色# ret user.roles.all()# print(ret) # QuerySet [Role: 保洁, Role: 销售]# 查询当前登录用户的所有权限 initial_session(request, user)return HttpResponse(登录成功)return render(request, login.html, locals())      5、注意点 注意点 1.白名单不需要任何权限的url valid_url_list [/login/, /reg/, /admin/.*] for valid_url in valid_url_list: ret re.match(valid_url, current_path) if ret: return 正则匹配2.校验是否登录 user_id request.session.get(user_id) if not user_id: return redirect(/login/)3.校验权限^ $ / 正则 permission_list request.session.get(permission_list,[]) flag False for permission in permission_list: # [/users/, /users/add/, /users/edit/(\\d)/, /users/delete/(\\d)/] # 需要 ^ $ 限定 permission ^%s$ % permission # 正则 ret re.match(permission, current_path) if ret: flag True break if not flag: return HttpResponse(无访问权限) 4、总结关于rbac 关于rbac (1) 创建表关系class User(models.Model):namemodels.CharField(max_length32)pwdmodels.CharField(max_length32)rolesmodels.ManyToManyField(toRole)def __str__(self): return self.nameclass Role(models.Model):titlemodels.CharField(max_length32)permissionsmodels.ManyToManyField(toPermission)def __str__(self): return self.titleclass Permission(models.Model):titlemodels.CharField(max_length32)urlmodels.CharField(max_length32)def __str__(self):return self.title(2) 基于admin录入数据(3) 登录校验if 登录成功:查询当前登录用户的权限列表注册到session中(4) 校验权限中间件的应用class ValidPermission(MiddlewareMixin):def process_request(self,request):# 当前访问路径current_path request.path_info# 检查是否属于白名单valid_url_list[/login/,/reg/,/admin/.*]for valid_url in valid_url_list:retre.match(valid_url,current_path)if ret:return None# 校验是否登录 user_idrequest.session.get(user_id)if not user_id:return redirect(/login/)# 校验权限permission_list request.session.get(permission_list,[]) # [/users/, /users/add, /users/delete/(\\d), users/edit/(\\d)] flag Falsefor permission in permission_list:permission ^%s$ % permissionret re.match(permission, current_path)if ret:flag Truebreakif not flag:return HttpResponse(没有访问权限)return None      转载于:https://www.cnblogs.com/venicid/p/9458776.html