blocks|key|328797|text|是的，您可以通过自定义Authorize属性来实现：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|328798|public+class+MyAuthorizeAttribute+:+AuthorizeAttribute
{
++++protected+override+bool+AuthorizeCore(HttpContextBase+httpContext)
++++{
++++++++var+authorized+=+base.AuthorizeCore(httpContext);
++++++++if+(!authorized)
++++++++{
++++++++++++return+false;
++++++++}

++++++++var+rd+=+httpContext.Request.RequestContext.RouteData;

++++++++var+id+=+rd.Values["id"];
++++++++var+userName+=+httpContext.User.Identity.Name;

++++++++Submission+submission+=+unit.SubmissionRepository.GetByID(id);
++++++++User+user+=+unit.UserRepository.GetByUsername(userName);

++++++++return+submission.UserID+==+user.UserID;
++++}
}|code-block|syntax|javascript|328799|然后：|328800|[MyAuthorize]
public+ActionResult+Edit(int+id)
{
++++//+Carry+out+method
}|328801|假设您需要提供这个提交实例，我们将其作为操作参数提取到自定义属性中以避免再次命中数据库，您可以执行以下操作：|328802|public+class+MyAuthorizeAttribute+:+AuthorizeAttribute
{
++++protected+override+bool+AuthorizeCore(HttpContextBase+httpContext)
++++{
++++++++var+authorized+=+base.AuthorizeCore(httpContext);
++++++++if+(!authorized)
++++++++{
++++++++++++return+false;
++++++++}

++++++++var+rd+=+httpContext.Request.RequestContext.RouteData;

++++++++var+id+=+rd.Values["id"];
++++++++var+userName+=+httpContext.User.Identity.Name;

++++++++Submission+submission+=+unit.SubmissionRepository.GetByID(id);
++++++++User+user+=+unit.UserRepository.GetByUsername(userName);

++++++++rd.Values["model"]+=+submission;

++++++++return+submission.UserID+==+user.UserID;
++++}
}|328803|328804|[MyAuthorize]
public+ActionResult+Edit(Submission+model)
{
++++//+Carry+out+method
}|328805|entityMap^0|0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|T|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|U|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|V|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|W|8|@]|9|@]|A|$E|F]]|$1|K|3|L|5|6|7|X|8|@]|9|@]|A|$]]|$1|M|3|N|5|D|7|Y|8|@]|9|@]|A|$E|F]]|$1|O|3|H|5|6|7|Z|8|@]|9|@]|A|$]]|$1|P|3|Q|5|D|7|10|8|@]|9|@]|A|$E|F]]|$1|R|3|-4|5|6|7|11|8|@]|9|@]|A|$]]]|S|$]]

Yes, you could achieve that through a custom Authorize attribute:

<pre><code>public class MyAuthorizeAttribute : AuthorizeAttribute
{
 protected override bool AuthorizeCore(HttpContextBase httpContext)
 {
 var authorized = base.AuthorizeCore(httpContext);
 if (!authorized)
 {
 return false;
 }

 var rd = httpContext.Request.RequestContext.RouteData;

 var id = rd.Values["id"];
 var userName = httpContext.User.Identity.Name;

 Submission submission = unit.SubmissionRepository.GetByID(id);
 User user = unit.UserRepository.GetByUsername(userName);

 return submission.UserID == user.UserID;
 }
}
</code></pre>

and then:

<pre><code>[MyAuthorize]
public ActionResult Edit(int id)
{
 // Carry out method
}
</code></pre>

and let's suppose that you need to feed this submission instance that we fetched into the custom attribute as action parameter to avoid hitting the database once again you could do the following:

<pre><code>public class MyAuthorizeAttribute : AuthorizeAttribute
{
 protected override bool AuthorizeCore(HttpContextBase httpContext)
 {
 var authorized = base.AuthorizeCore(httpContext);
 if (!authorized)
 {
 return false;
 }

 var rd = httpContext.Request.RequestContext.RouteData;

 var id = rd.Values["id"];
 var userName = httpContext.User.Identity.Name;

 Submission submission = unit.SubmissionRepository.GetByID(id);
 User user = unit.UserRepository.GetByUsername(userName);

 rd.Values["model"] = submission;

 return submission.UserID == user.UserID;
 }
}
</code></pre>

and then:

<pre><code>[MyAuthorize]
public ActionResult Edit(Submission model)
{
 // Carry out method
}
</code></pre>

blocks|key|545683|text|我推荐阅读AuthorizeAttribute+(参见here)。还有，你看过this的帖子吗？它介绍了如何覆盖身份验证属性内部，以及如何使用IPrincipal和IIdentity。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|545684|entityMap|0|LINK|mutability|MUTABLE|url|http://msdn.microsoft.com/en-us/library/system.web.mvc.authorizeattribute%2528v=vs.98%2529.aspx|1|https://stackoverflow.com/questions/6432592/mvc3-custom-authorizeattribute-how-to-pass-in-an-object-from-controller^0|5|I|R|4|0|13|4|1|0^^$0|@$1|2|3|4|5|6|7|P|8|@$9|Q|A|R|B|C]]|D|@$9|S|A|T|1|U]|$9|V|A|W|1|X]]|E|$]]|$1|F|3|-4|5|6|7|Y|8|@]|D|@]|E|$]]]|G|$H|$5|I|J|K|E|$L|M]]|N|$5|I|J|K|E|$L|O]]]]

I recommend reading up on the <code>AuthorizeAttribute</code> (see <a href="http://msdn.microsoft.com/en-us/library/system.web.mvc.authorizeattribute%28v=vs.98%29.aspx" rel="nofollow noreferrer">here</a>). Also, have you seen <a href="https://stackoverflow.com/questions/6432592/mvc3-custom-authorizeattribute-how-to-pass-in-an-object-from-controller">this</a> post? It goes over how to override the authentication attribute innards and how to use IPrincipal and IIdentity.

blocks|key|328904|text|我建议您将逻辑从操作/控制器中提取出来，并构建一个域类来处理该逻辑。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|328905|Action方法实际上应该只处理从视图获取数据和向视图发送数据。您可以创建一些足够通用的东西来处理您的需求，但也将遵循单一责任原则。|328906|public+class+AuthorizedToEdit+
{
+++++protected+override+bool+AuthorizeCore(string+user,+int+itemId)
+++++{
+++++++++var+userName+=+httpContext.User.Identity.Name;

+++++++++var+authUsers+=+SubmissionRepository.GetAuthoriedUsers(itemId);

+++++++++return+authUsers.Contains(user);
+++++}
}|code-block|syntax|javascript|328907|这还允许您在以后灵活地允许管理员用户等操作|328908|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|N|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|O|8|@]|9|@]|A|$G|H]]|$1|I|3|J|5|6|7|P|8|@]|9|@]|A|$]]|$1|K|3|-4|5|6|7|Q|8|@]|9|@]|A|$]]]|L|$]]

I would suggest you pull the logic out of the action/controller and build a domain class to handle that logic.

Action methods should really only deal with getting data from and sending data to the view. You could create something generic enough to handle your needs but will also follow the single responsibility principal.

<pre><code>public class AuthorizedToEdit 
{
 protected override bool AuthorizeCore(string user, int itemId)
 {
 var userName = httpContext.User.Identity.Name;

 var authUsers = SubmissionRepository.GetAuthoriedUsers(itemId);

 return authUsers.Contains(user);
 }
}
</code></pre>

This would also allow you to have the flexibility later on to allow something like admin users

blocks|key|328945|text|@if+(Request.IsAuthenticated+&&+User.IsInRole("Student"))
++++{
++++@Html.ActionLink("Edit",+"Edit",+new+{+id+=+item.StdID+})
++++}|type|code-block|depth|inlineStyleRanges|entityRanges|data|syntax|javascript|328946|在我的例子中，loggedIn用户是一名学生。所以我说，如果登录请求通过了身份验证，并且他的角色是学生，那么他就可以访问编辑链接。|unstyled|328947|下面允许您让普通用户或管理员也执行编辑。|328948|@if(Request.IsAuthenticated+&&+User.IsInRole("Student")+%7C%7C+
User.IsInRole("Administrator"))
{
+@Html.ActionLink("Edit",+"Edit",+new+{+id+=+item.StdID+})
}|328949|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$B|C]]|$1|D|3|E|5|F|7|N|8|@]|9|@]|A|$]]|$1|G|3|H|5|F|7|O|8|@]|9|@]|A|$]]|$1|I|3|J|5|6|7|P|8|@]|9|@]|A|$B|C]]|$1|K|3|-4|5|F|7|Q|8|@]|9|@]|A|$]]]|L|$]]

<pre><code>@if (Request.IsAuthenticated &amp;&amp; User.IsInRole("Student"))
 {
 @Html.ActionLink("Edit", "Edit", new { id = item.StdID })
 }
</code></pre>

in my case, the loggedIn user is a student. so i say if the login request is authenticated, and if his role is student, then let the link for edit be accessible to him.

this below allows you to let the ordinary user OR the Admin perform edit also.

<pre><code>@if(Request.IsAuthenticated &amp;&amp; User.IsInRole("Student") || 
User.IsInRole("Administrator"))
{
 @Html.ActionLink("Edit", "Edit", new { id = item.StdID })
}
</code></pre>

I have a controller method called <code>Edit</code> in which the user can edit data they had created like so ...

<pre><code>public ActionResult Edit(int id)
{
 Submission submission = unit.SubmissionRepository.GetByID(id);
 User user = unit.UserRepository.GetByUsername(User.Identity.Name);

 //Make sure the submission belongs to the user
 if (submission.UserID != user.UserID)
 {
 throw new SecurityException("Unauthorized access!");
 }

 //Carry out method
}
</code></pre>

This method works fine however it is a little messy to put in every controller Edit method. Each table always has a <code>UserID</code> so I was wondering if there was an easier way to automate this via an <code>[Authorize]</code> Attribute or some other mechanism to make the code cleaner.

ASP.NET MVC Attribute to only let user edit his/her own content

身份验证

数据库

我有一个名为Edit的控制器方法，用户可以在其中编辑他们创建的数据，如下所示...public ActionResult Edit(int id){    Submission submission = unit.SubmissionRepository.GetByID(id);    User user = unit...

问ASP.NET MVC属性，仅允许用户编辑自己的内容
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问ASP.NET MVC属性，仅允许用户编辑自己的内容EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问ASP.NET MVC属性，仅允许用户编辑自己的内容
EN