修改用户验证

CallCenterApi/CallCenterApi.Interface/CallCenterApi.Interface/App_Start/AuthorizeAttribute.cs

@@ -7,30 +7,43 @@ using System.Linq;
 using System.Web;
 using System.Web.Mvc;
 using System.Web.Routing;
+using System.Web.Security;
 
 namespace CallCenterApi.Interface
 {
     public class AuthorityAttribute : AuthorizeAttribute
     {
-        private BLL.T_Sys_RoleFunction roleFunctionBLL = new BLL.T_Sys_RoleFunction();
         /// <summary>
         /// 权限验证
         /// </summary>
         /// <param name="filterContext"></param>
         public override void OnAuthorization(AuthorizationContext filterContext)
         {
-            //bool isAuth = false;
-            if (filterContext.RequestContext.HttpContext.Request.IsAuthenticated)
+            var context = filterContext.RequestContext.HttpContext;
+            var token = context.Request["token"];
+            if (!string.IsNullOrEmpty(token))
             {
                 try
                 {
-                    var us = (FormsPrincipal<Dictionary<string, string>>)filterContext.RequestContext.HttpContext.User;
-
-                    var user= new BLL.T_Sys_UserAccount().GetModel(us.UserData["F_UserCode"]);
-                    if (user == null || user.F_RoleId.ToString() != us.UserData["F_RoleID"])
+                    bool isAuth = false;
+                    //获取FormsAuthenticationTicket对象
+                    FormsAuthenticationTicket ticket = FormsAuthentication.Decrypt(token);
+                    if (ticket != null && !ticket.Expired && !string.IsNullOrEmpty(ticket.UserData))
+                    {
+                        Dictionary<string, string> userData = ticket.UserData.ToObject<Dictionary<string, string>>();
+                        if (userData != null)
+                        {
+                            var user = new BLL.T_Sys_UserAccount().GetModel(userData["F_UserCode"]);
+                            if (user != null && user.F_RoleId.ToString() == userData["F_RoleID"])
+                            {
+                                isAuth = true;
+                                context.User = new FormsPrincipal<Model.T_Sys_UserAccount>(ticket, user);//重新给context.User赋值。
+                            }
+                        }
+                    }
+                    if (!isAuth)
                     {
-                        //角色改变时重新登录
-                        filterContext.RequestContext.HttpContext.Response.StatusCode = 200;
+                        context.Response.StatusCode = 200;
                         filterContext.Result = new ContentResult { Content = new AjaxResult { state = ResultTypes.notoken.ToString(), message = "token无效或过期，请重新登录。" }.ToJson() };
                         return;
                     }
@@ -38,65 +51,22 @@ namespace CallCenterApi.Interface
                 catch (Exception ex)
                 {
                     WriteLog(filterContext, "验证失败：" + ex.ToString());
-                    filterContext.RequestContext.HttpContext.Response.StatusCode = 200;
+                    context.Response.StatusCode = 200;
                     filterContext.Result = new ContentResult { Content = new AjaxResult { state = ResultTypes.notoken.ToString(), message = "token无效或过期，请重新登录。" }.ToJson() };
                     return;
                 }
-
-                //var actionDescriptor = filterContext.ActionDescriptor;
-                //var controllerDescriptor = actionDescriptor.ControllerDescriptor;
-                //var controller = controllerDescriptor.ControllerName;
-                //var action = actionDescriptor.ActionName;
-                //var token = filterContext.HttpContext.Request["token"];
-
-                ////var userData = CacheHelper.Get<Dictionary<string, string>>(token);
-                //var userDatastr = RedisHelper.StringGet(CommonHelper.MD5(token));
-                //if (userDatastr != null)
-                //{
-                //    //Dictionary<string, string> userData = new Dictionary<string, string>();
-                //    //userData = userDatastr.ToString().ToObject<Dictionary<string, string>>();
-                //    //var roleId = Utils.StrToInt(userData["F_RoleID"], 0);
-
-                //    //var roleId = Utils.StrToInt(userData["F_RoleID"], 0);
-                //    //var role = new BLL.T_Sys_RoleInfo().GetModel(roleId);
-                //    //if (role != null)
-                //    //{
-                //    //    isAuth = true;
-                //    //    //var roleFunctionList = roleFunctionBLL.GetModelList(" F_RoleId=" + role.F_RoleId);
-                //    //    ////var str = string.Join(",", roleFunctionList.Select(x => x.F_FunctionId).ToArray());
-                //    //    //var moduleFunction = new BLL.T_Sys_Function().GetModel(roleId);
-                //    //    //if (moduleFunction != null)
-                //    //    //{
-                //    //    //    var single = roleFunctionList.SingleOrDefault(x => x.F_FunctionId == moduleFunction.F_FunctionId);
-                //    //    //    if (single != null)
-                //    //    //    {
-                //    //    //        isAuth = true;
-                //    //    //    }
-                //    //    //}
-                //    //}
-                //}
             }
             else
             {
-                filterContext.RequestContext.HttpContext.Response.StatusCode = 200;
-                filterContext.Result = new ContentResult { Content = new AjaxResult { state = ResultTypes.notoken.ToString(), message = "token无效或过期，请重新登录。"}.ToJson() };
-                WriteLog(filterContext, "token无效或过期，请重新登录。");
+                context.Response.StatusCode = 200;
+                filterContext.Result = new ContentResult { Content = new AjaxResult { state = ResultTypes.notoken.ToString(), message = "未传入token，请重新登录。" }.ToJson() };
                 return;
             }
 
-            //if (!isAuth)
-            //{
-            //    filterContext.HttpContext.Response.StatusCode = 200;
-            //    filterContext.Result = new ContentResult { Content = new AjaxResult { state = ResultTypes.unauthorized.ToString(), message = "对不起，您无权访问！" }.ToJson() };
-            //    WriteLog(filterContext);
-            //}
-            //else {
-            if (filterContext!=null)
+            if (filterContext != null)
             {
                 base.OnAuthorization(filterContext);
             }
-            
-            //}
         }
         private void WriteLog(AuthorizationContext filterContext,string error)
         {

CallCenterApi/CallCenterApi.Interface/CallCenterApi.Interface/Controllers/Base/BaseController.cs

@@ -16,9 +16,9 @@ namespace CallCenterApi.Interface.Controllers.Base
             {
                 try
                 {
-                    var us= (FormsPrincipal<Dictionary<string, string>>)base.User;
+                    var us= (FormsPrincipal<Model.T_Sys_UserAccount>)base.User;
 
-                    return new BLL.T_Sys_UserAccount().GetModel(us.UserData["F_UserCode"]);
+                    return us.UserData;
                 }
                 catch
                 {

CallCenterApi/CallCenterApi.Interface/CallCenterApi.Interface/Global.asax.cs

@@ -38,14 +38,6 @@ namespace CallCenterApi.Interface
             Dictionary<string, string> Params = new Dictionary<string, string>();
             Params.Add("request_url", context.Request.Url.ToString());
 
-            //foreach (var key in context.Request.Params.AllKeys)
-            //{
-            //    if (key == "ALL_HTTP")
-            //    {
-            //        break;
-            //    }
-            //    Params.Add(key, context.Request.Params[key]);
-            //}
             bool issafe = true;
             foreach (var key in context.Request.Params.AllKeys)
             {
@@ -79,49 +71,6 @@ namespace CallCenterApi.Interface
             {
                 log.Debug(Params.ToJson());
             }
-
-            var token = context.Request["token"];
-            if (string.IsNullOrWhiteSpace(token))
-            {
-                //log.Debug(Params.ToJson());
-                return;
-            }
-            try
-            {
-                //////获取缓存
-                ////var dict = CacheHelper.Get(token);
-                ////获取redis缓存
-                //var dict = RedisHelper.StringGet(CommonHelper.MD5(token));
-                
-                //if (dict == null)
-                //{
-                //    //log.Debug(Params.ToJson());
-                //    return;
-                //}
-                Dictionary<string, string> userData = null;
-                //获取FormsAuthenticationTicket对象
-                FormsAuthenticationTicket ticket = FormsAuthentication.Decrypt(token);
-                if (ticket != null)
-                {
-                    if (!ticket.Expired)
-                    {
-                        if (!string.IsNullOrEmpty(ticket.UserData))
-                            userData = (new JavaScriptSerializer()).Deserialize<Dictionary<string, string>>(ticket.UserData); //还原用户数据
-                        if (userData != null)
-                            context.User = new FormsPrincipal<Dictionary<string, string>>(ticket, userData);//重新给context.User赋值。
-                    }
-                    //log.Debug(ticket.ToJson());
-                }
-                //var obj = new { UserCode = userData["F_UserCode"], Params = Params };
-                //log.Debug(Params.ToJson());
-
-            }
-            catch (Exception ex){
-                /* 有异常也不要抛出，防止攻击者试探。 */
-                log.Debug(ex.ToString());
-            }
         }
-
-
     }
 }