Django框架----权限组件（具体代码实现）

其他 2018-04-27 18:54:35 阅读次数: 2

1、settings

"""
Django settings for day80 project.

Generated by 'django-admin startproject' using Django 1.11.6.

For more information on this file, see
https://docs.djangoproject.com/en/1.11/topics/settings/

For the full list of settings and their values, see
https://docs.djangoproject.com/en/1.11/ref/settings/
"""

import os

# Build paths inside the project like this: os.path.join(BASE_DIR, ...)
BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))


# Quick-start development settings - unsuitable for production
# See https://docs.djangoproject.com/en/1.11/howto/deployment/checklist/

# SECURITY WARNING: keep the secret key used in production secret!
SECRET_KEY = '7x(f$0j0c#)hn)8i(uv6j*sg^h_7v9$eak#pu_n4ji05=v28ca'

# SECURITY WARNING: don't run with debug turned on in production!
DEBUG = True

ALLOWED_HOSTS = []


# Application definition

INSTALLED_APPS = [
    'django.contrib.admin',
    'django.contrib.auth',
    'django.contrib.contenttypes',
    'django.contrib.sessions',
    'django.contrib.messages',
    'django.contrib.staticfiles',
    'app01.apps.App01Config',
    'rbac',
]
from django.middleware.common import CommonMiddleware
MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
    'rbac.middlewear.rbac.Middle',
]

ROOT_URLCONF = 'day80.urls'

TEMPLATES = [
    {
        'BACKEND': 'django.template.backends.django.DjangoTemplates',
        'DIRS': [os.path.join(BASE_DIR, 'templates')]
        ,
        'APP_DIRS': True,
        'OPTIONS': {
            'context_processors': [
                'django.template.context_processors.debug',
                'django.template.context_processors.request',
                'django.contrib.auth.context_processors.auth',
                'django.contrib.messages.context_processors.messages',
            ],
        },
    },
]

WSGI_APPLICATION = 'day80.wsgi.application'


# Database
# https://docs.djangoproject.com/en/1.11/ref/settings/#databases

DATABASES = {
    'default': {
        'ENGINE': 'django.db.backends.sqlite3',
        'NAME': os.path.join(BASE_DIR, 'db.sqlite3'),
    }
}


# Password validation
# https://docs.djangoproject.com/en/1.11/ref/settings/#auth-password-validators

AUTH_PASSWORD_VALIDATORS = [
    {
        'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator',
    },
    {
        'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator',
    },
    {
        'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator',
    },
    {
        'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator',
    },
]


# Internationalization
# https://docs.djangoproject.com/en/1.11/topics/i18n/

LANGUAGE_CODE = 'en-us'

TIME_ZONE = 'UTC'

USE_I18N = True

USE_L10N = True

USE_TZ = True


# Static files (CSS, JavaScript, Images)
# https://docs.djangoproject.com/en/1.11/howto/static-files/

STATIC_URL = '/static/'
# ==========静态文件配置=========
STATICFILES_DIRS = (
    os.path.join(BASE_DIR,'static'),
)
# ==========rbac============
PERMISSION_URL_DICT = "permission_url_list"
PERMISSION_MENU_KEY = "permission_menu_list"

# =========白名单（不需要权限就可以看到的）==========
WHITE_LIST =[
     "/login/",
     "/admin.*",
     "/index/",
]
settings.py

2、rbac应用下的models

from django.db import models

# Create your models here.
class Role(models.Model):
    title = models.CharField(max_length=32,verbose_name="角色")
    permissions = models.ManyToManyField(to="Permission",verbose_name="拥有权限的角色",blank=True)  #权限和角色是多对多的关系

    def __str__(self):
        return self.title
    class Meta:
        verbose_name_plural = "角色表"

class Permission(models.Model):
    title = models.CharField(max_length=32,verbose_name="权限名")
    url = models.CharField(max_length=32,verbose_name="带正则的url")
    codes = models.CharField(max_length=32,verbose_name="代码")
    group = models.ForeignKey(to="Group",verbose_name="所属组",blank=True)  #组和权限是一对多的关系，一个组有多个权限
    menu_gp = models.ForeignKey(to='Permission',related_name='aaa',null=True,blank=True,verbose_name="组内菜单")
    def __str__(self):
        return self.title
    class Meta:
        verbose_name_plural = "权限表"

class UserInfo(models.Model):
    name = models.CharField(max_length=32,verbose_name="姓名")
    password = models.CharField(max_length=64,verbose_name="密码")
    email = models.CharField(max_length=32,verbose_name="邮箱")
    roles = models.ManyToManyField(to="Role",blank=True)  #用户和角色是多对多的关系
    def __str__(self):
        return self.name
    class Meta:
        verbose_name_plural = "用户表"

class Group(models.Model):
    title = models.CharField(max_length=32,verbose_name="组名称")
    menu = models.ForeignKey(to="Menu",verbose_name="组内菜单",blank=True)  #一个组下有多个菜单
    def __str__(self):
        return self.title
    class Meta:
        verbose_name_plural = "组"

class Menu(models.Model):
    caption = models.CharField(max_length=32,verbose_name="菜单")
    def __str__(self):
        return self.caption
    class Meta:
        verbose_name_plural = "菜单表"
models.py

3、urls

from django.conf.urls import url
from django.contrib import admin
from app01 import views
urlpatterns = [
    url(r'^admin/', admin.site.urls),
    url(r'^login/$', views.login),
    url(r'^index/$', views.index),
    url(r'^userinfo/$', views.userinfo),
    url(r'^userinfo/add/$', views.userinfo_add),
    url(r'^userinfo/del/(\d+)/$', views.userinfo_del),
    url(r'^userinfo/edit/(\d+)/$', views.userinfo_edit),
    url(r'^order/$', views.order),
    url(r'^order/add/$', views.order_add),
    url(r'^order/del/(\d+)/$', views.order_del),
    url(r'^order/edit/(\d+)/$', views.order_edit),
]
urls.py

4、初始化   server--init_permission

#!usr/bin/env python
# -*- coding:utf-8 -*-
from django.conf import settings
def init_permission(user, request):
    '''
    初始化权限信息，获取权限信息并放置到session中
    :param user:
    :param request:
    :return:
    '''
    permission_list = user.roles.values('permissions__id',
                                        'permissions__title',  # 用户列表
                                        'permissions__url',
                                        'permissions__codes',
                                        'permissions__menu_gp_id',  # 组内菜单ID，Null表示是菜单
                                        'permissions__group_id',
                                        'permissions__group__menu_id',  # 菜单ID
                                        'permissions__group__menu__caption',  # 菜单名称
                                        ).distinct()  # 获取当前角色对象的所有的权限并去重
    # print(permission_list)
    # 权限相关
    url_dict = {}
    for item in permission_list:
        group_id = item["permissions__group_id"]
        url = item["permissions__url"]
        code = item["permissions__codes"]
        # print("code_list", code)
        if group_id in url_dict:
            url_dict[group_id]["code"].append(code)  # 如果id在里面就把code和url添加进去
            url_dict[group_id]["urls"].append(url)
        else:
            # 如果不在就设置
            url_dict[group_id] = {
                "code": [code, ],
                "urls": [url, ]
            }
    request.session[settings.PERMISSION_URL_DICT] = url_dict
    print(url_dict)


    #菜单相关
    # 1、先去掉不是菜单的
    menu_list = []
    for item in permission_list:
        tpl = {
            "id":item["permissions__id"],
            "title":item["permissions__title"],
            "url":item["permissions__url"],
            "menu_gp_id":item["permissions__menu_gp_id"],
            "menu_id":item["permissions__group__menu_id"],
            "menu_title":item["permissions__group__menu__caption"]
        }
        menu_list.append(tpl)
    request.session[settings.PERMISSION_MENU_KEY] = menu_list
    print("============",menu_list)
sever下的init_permission.py

5、app01下的views

from django.shortcuts import render, redirect, HttpResponse
from django.conf import settings
# Create your views here.
from rbac import models
import re
from rbac.service.init_permission import init_permission
class BasePagPermission(object):
    def __init__(self, code_list):
        self.code_list = code_list

    def has_add(self):
        if "add" in self.code_list:
            return True

    def has_del(self):
        if "del" in self.code_list:
            return True

    def has_edit(self):
        if "edit" in self.code_list:
            return True


def login(request):
    if request.method == "GET":
        return render(request, "login.html")
    else:
        username = request.POST.get("username")
        password = request.POST.get("password")
        user = models.UserInfo.objects.filter(name=username, password=password).first()
        if user:
            init_permission(user, request)
            return redirect("/userinfo/")
        else:
            return render(request, "login.html")


def index(request):
    return render(request, "index.html")


def userinfo(request):
    pagpermission = BasePagPermission(request.permission_code_url)  # 实例化
    # print("code......", request.permission_code_url)
    data_list = [
        {"id": 1, "name": "haiyan1"},
        {"id": 2, "name": "haiyan2"},
        {"id": 3, "name": "haiyan3"},
        {"id": 4, "name": "haiyan4"},
        {"id": 5, "name": "haiyan5"},
    ]
    #print("data_list",data_list)
    #print("pagpermission",pagpermission)
    return render(request, "userinfo.html", {"data_list": data_list, "pagpermission": pagpermission})


def userinfo_add(request):
    if request.method == "GET":
        return render(request,"userinfo_add.html")
    else:
        return redirect("/userinfo/")


def userinfo_del(request, nid):
    return HttpResponse("删除用户")


def userinfo_edit(request, nid):
    return HttpResponse("编辑用户")


def order(request):
    pagpermission = BasePagPermission(request.permission_code_url)  # 实例化
    print("code......", request.permission_code_url)
    return render(request,"order.html",{"pagpermission":pagpermission})


def order_add(request):
    return HttpResponse("添加订单")


def order_del(request, nid):
    return HttpResponse("删除订单")


def order_edit(request, nid):
    return HttpResponse("编辑订单")
views.py

6、中间件

#!usr/bin/env python
# -*- coding:utf-8 -*-
from django.shortcuts import render, redirect, HttpResponse
from django.conf import settings
import re


class MiddlewareMixin(object):
    def __init__(self, get_response=None):
        self.get_response = get_response
        super(MiddlewareMixin, self).__init__()

    def __call__(self, request):
        response = None
        if hasattr(self, 'process_request'):
            response = self.process_request(request)
        if not response:
            response = self.get_response(request)
        if hasattr(self, 'process_response'):
            response = self.process_response(request, response)
        return response


class Middle(MiddlewareMixin):  # 必须去继承这个类
    def process_request(self, request):
        current_url = request.path_info  # 获取当前请求的路径

        # 如果匹配的是白名单里面的就让通过，不需要权限
        for url in settings.WHITE_LIST:
            if re.match(url, current_url):
                return None
        permission_dict = request.session.get(settings.PERMISSION_URL_DICT)  # 获取session
        if not permission_dict:  # 如果没有得到，就直接跳转到login页面
            return redirect("/login/")

        flag = False
        for group_id, code_url in permission_dict.items():
            for db_url in code_url["urls"]:
                regex = "^{0}$".format(db_url)
                # 因为match匹配的时候会把你只要有的都匹配到了，我们只匹配当前的url，所以得加一个起始终止符
                # print(regex, current_url)
                if re.match(regex, current_url):
                    # print(1111111)
                    request.permission_code_url = code_url["code"]  # 用户输入的url和数据库的url匹配成功之后成功之后先把code保存在request中，方便以后判断
                    flag = True
                    break  # 如果匹配成功就进入页面
                    # 注意在这里不能用return，在中间件中process_request这个函数如果有return就只会执行自己的
                    #   response和上面的response,不会执行后续的。没有return就会去继续执行后续中间件和视图函数
            if flag:  # 结束外层循环
                break
        if not flag:
            return HttpResponse("无权访问")  # 如果访问不成功就显示无权访问

    def process_reponse(self, request, response):
        return response
middlewear下的rbac.py

7、templatetags下的rbac.py

#!usr/bin/env python
# -*- coding:utf-8 -*-
from django.conf import settings
import re
from django.template import Library
register = Library()
@register.inclusion_tag("xxxx.html")
def menu_html(request):
    """
       去Session中获取菜单相关信息，匹配当前URL，生成菜单
       :param request:
       :return:
       """
    menu_list = request.session.get(settings.PERMISSION_MENU_KEY)
    current_url = request.path_info
    menu_dict = {}
    for item in menu_list:
        # 循环找到可以作为菜单的权限
        if not item["menu_gp_id"]:
            menu_dict[item["id"]] = item
    # 正则匹配添加active
    for item in menu_list:
        regex = "^{0}$".format(item["url"])
        if re.match(regex, current_url):
            # 匹配成功在根据id去判断,如果菜单id有值就不是菜单，则去找它的值对应的id,添加active
            # ，为null时就是菜单,直接给自己添加一个active
            if not item["menu_gp_id"]:  #是菜单
                menu_dict[item["id"]]["active"] = True
            else:
                menu_dict[item["menu_gp_id"]]["active"] = True

    result = {}
    for item in menu_dict.values():
        active = item.get("active")
        menu_id = item["menu_id"]
        if menu_id in result:
            result[menu_id]["children"].append({'title': item['title'], 'url': item['url'], 'active': active})
            if active:
                result[menu_id]["active"] = True
        else:
            result[menu_id] = {
                'menu_id': item['menu_id'],
                'menu_title': item['menu_title'],
                'active': active,
                'children': [
                    {'title': item['title'], 'url': item['url'], 'active': active}
                ]
            }
    print("result",result)
    return {"menu_dict":result}
自定义标签rbac.py

8、template

{% load rbac %}
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width">
    <title>Title</title>
    <link rel="stylesheet" href="/static/rbac/rbac.css">
</head>
<body>
<div class="aaa">
    <div class="left">
        {% menu_html request %}
    </div>
    <div class="right">
        {% block content %}

        {% endblock %}
    </div>
</div>
<script src="/static/jquery-3.2.1.min.js"></script>
<script src="/static/rbac/rbac.js"></script>

</body>
</html>
base.html 
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width">
    <title>Title</title>
</head>
<body>
<h1>hello--{{ user.name }}</h1>
</body>
</html>
index.html 
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width">
    <title>Title</title>
</head>
<body>
<form method="post" action="/login/">
    {% csrf_token %}
    <p>姓名：<input type="text" name="username"></p>
    <p>密码：<input type="password" name="password"></p>
    <p><input type="submit" value="提交"></p>
</form>
</body>
</html>
login.html 
{% extends "base.html" %}
{% block content %}
<h1>订单页面</h1>
{% endblock %}
order.html 
{% extends "base.html" %}
{% block content %}
{% if pagpermission.has_add %}
        <a href="/userinfo/add/">添加</a>
        {% endif %}
        <table border="1">
            <thead>
                <th>编号</th>
                <th>姓名</th>
                <th>操作</th>
            </thead>
            <tbody>
            {% for row in data_list %}
                <tr>
                    <td>{{ row.id }}</td>
                    <td>{{ row.name }}</td>
                    <td>
                        {% if pagpermission.has_edit %}
                         <a href="#">编辑</a>
                        {% endif %}
                       {% if pagpermission.has_del %}
                        <a href="#">删除</a>
                       {% endif %}
                    </td>
                </tr>
            {% endfor %}
            </tbody>
        </table>
{% endblock %}
userinfo.html 
{% extends "base.html" %}
{% block content %}
<form action="" method="post">
    {% csrf_token %}
    <p>编号：<input type="text" name="bianhao"></p>
    <p>姓名：<input type="text" name="name"></p>
    <input type="submit" value="提交">
</form>
{% endblock %}
userinfo_add.html 
{% for k,item in menu_dict.items %}
 <div class="item-title">{{ item.menu_title }}</div>
     {% if item.active %}
            <div class="item-permission">
        {% else %}
            <div class="item-permission hide">
        {% endif %}
        {% for v in item.children %}
            {% if v.active %}
                    <a href="{{ v.url }}" class="active">{{ v.title }}</a>
            {% else %}
                    <a href="{{ v.url }}">{{ v.title }}</a>
            {% endif %}
        {% endfor %}
    </div>
{% endfor %}

{# <div class="item-title">菜单一</div>#}
{#        <div class="item-permission">#}
{#            <a href="">用户列表</a>#}
{#            <a href="">订单列表</a>#}
{#        </div>#}
{#    <div class="item-title">菜单二</div>#}
{#        <div class="item-permission hide">#}
{#            <a href="">用户列表</a>#}
{#            <a href="">订单列表</a>#}
{#        </div>#}
xxxx.html

9、static---rbac---rbac.css

.left{
    float: left;
    width: 20%;
    height: 500px;
    background-color: coral;
    padding: 20px 20px;
}
.right{
    width: 80%;
    height: 500px;
    background-color: azure;
}
.item-permission a{
    display: block;
}
.hide{
    display: none;
}
.item-permission a.active{
    color: red;
}
rbac.css

10、static---rbac---rbac.js

// 方式一
$(function () {
        $(".item-title").click(function () {
              $(this).next().toggleClass("hide")
        })
    });
// 方式二：
//  $(function () {
//     $('.item-title').click(function () {
//         if($(this).next().hasClass('hide')){
//             $(this).next().removeClass('hide')
//         }else{
//             $(this).next().addClass('hide')
//         }
//     })
//  });
rbac.js

猜你喜欢

转载自www.cnblogs.com/jiangshanduojiao/p/8947061.html
今日推荐
火速冲上 GitHub 热榜 —— 开源编程语言、框架哪有这么可爱？
北京人形机器人创新中心发布全球首个纯电驱拟人奔跑的全尺寸人形机器人“天工”
LFOSSA 源来如此公开课 | 掌握云原生未来：CNCF 认证全面攻略与备考秘籍
国产云输入法——仅华为无云端数据上传安全问题
开源日报 | 工业开源项目OGG 1.0；姐姐，你要和我一起配置火狐吗；苹果AI遥遥落后？Fedora 40
开放签电子签章：停止新增，优化体验，前进更进（五一假期前工作）
开源日报 | 中学生开源前端动画引擎；全球首个Llama3 8B中文版开源模型；联想电脑恐出局；Linus讽刺AI炒作
周排行
浏览器对同一域名进行请求的最大并发连接数
React Hook之自定义Hook
【转】MyBatis缓存机制
-Java-泛型
自动化测试常用脚本-发送邮件
LeetCode#859: Buddy Strings
java、Python处理字符串
第二篇の博客
Hadoop伪分布式环境安装
SQL Server进阶（十一）临时表、表变量
每日归档
更多
2024-04-27(56)
2024-04-26(39)
2024-04-25(22)
2024-04-24(36)
2024-04-23(26)
2024-04-22(39)
2024-04-21(0)
2024-04-20(6)
2024-04-19(5)
2024-04-18(0)

代码天地 © 2018 codetd.com

境外服务器   最新电视剧2022