本文实例讲述了Yii中srbac权限扩展模块工作原理与用法。分享给大家供大家参考,具体如下:
1. 设置权限规则表:可放在module模块配置文件里面
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
|
public function init() {
//操作权限表,必须存在以下字段:
//itemname角色名/ID,
//type授权项目类型/1(任务)或者2(角色),
//bizrule权限/逻辑运算表达式为false是有权限操作,
//data数据/YII暂无利用
Yii::app()->authManager->itemTable = 'AuthItem' ;
//会员组-权限对应表,必须存在以下字段:
//child子角色/ID,
//parent父角色/ID,此表可循环执行,可多级继承
Yii::app()->authManager->itemChildTable = 'uthItemChild' ;
//会员-会员组对应表,会员组可直接为操作名称,必须存在以下字段:
//itemname角色名/ID,
//userid用户名/ID,
//bizrule权限/逻辑运算表达式为false是有权限操作,
//data数据/YII暂无利用
Yii::app()->authManager->assignmentTable = 'zd_mem_glog' ;
|
2. 实现规则,所在控制器继承基类SBaseController,原来为Controller
1
2
3
4
5
6
7
8
|
class ProductController extends SBaseController
{
........
}
class SBaseController extends Controller
{
........
}
|
3. SBaseController继承基类Controller,前填加beforeAction,实现权限验证。
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
|
protected function beforeAction( $action ) {
//载入模块分隔符
$del = Helper::findModule( 'srbac' )->delimeter;
//取得前模块名称
$mod = $this ->module !== null ? $this ->module->id . $del : "" ;
$contrArr = explode ( "/" , $this ->id);
$contrArr [sizeof( $contrArr ) - 1] = ucfirst( $contrArr [sizeof( $contrArr ) - 1]);
$controller = implode( "." , $contrArr );
$controller = str_replace ( "/" , "." , $this ->id);
// 生成静态页面 模块+分隔符+控制器(首字母大写)+方法(首字母大写)例: model-ControllerAction
if (sizeof( $contrArr )==1){
$controller = ucfirst( $controller );
}
$access = $mod . $controller . ucfirst( $this ->action->id);
//验证访问页面地址是否在总是允许列表里面,是返回有权限
if (in_array( $access , $this ->allowedAccess())) {
return true;
}
//验证SRBAC有无安装,没在安装,返回的权限访问
if (!Yii::app()->getModule( 'srbac' )->isInstalled()) {
return true;
}
//验证SRBAC有无开启,没在开启,返回的权限访问
if (Yii::app()->getModule( 'srbac' )->debug) {
return true;
}
// 权限验证
if (!Yii::app()->user->checkAccess( $access ) || Yii::app()->user->isGuest) {
$this ->onUnauthorizedAccess();
} else {
return true;
}
}
|
4. CDbAuthManager读取当前用户角色
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
|
public function getAuthAssignments( $userId )
{
$rows = $this ->db->createCommand()
->select()
->from( $this ->assignmentTable)
->where( 'userid=:userid' , array ( ':userid' => $userId ))
->queryAll();
$assignments = array ();
foreach ( $rows as $row )
{
if (( $data =@unserialize( $row [ 'data' ]))===false)
$data =null;
$assignments [ $row [ 'itemname' ]]= new CAuthAssignment( $this , $row [ 'itemname' ], $row [ 'userid' ], $row [ 'bizrule' ], $data );
}
return $assignments ;
}
|
5. CDbAuthManager读取角色对应权限
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
|
public function getAuthItem( $name )
{
$row = $this ->db->createCommand()
->select()
->from( $this ->itemTable)
->where( 'name=:name' , array ( ':name' => $name ))
->queryRow();
if ( $row !==false)
{
if (( $data =@unserialize( $row [ 'data' ]))===false)
$data =null;
return new CAuthItem( $this , $row [ 'name' ], $row [ 'type' ], $row [ 'description' ], $row [ 'bizrule' ], $data );
}
else
return null;
}
|
6. CDbAuthManager读取权限对应操作
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
|
protected function checkAccessRecursive( $itemName , $userId , $params , $assignments )
{
if (( $item = $this ->getAuthItem( $itemName ))===null)
return false;
Yii::trace( 'Checking permission "' . $item ->getName(). '"' , 'system.web.auth.CDbAuthManager' );
if (!isset( $params [ 'userId' ]))
$params [ 'userId' ] = $userId ;
if ( $this ->executeBizRule( $item ->getBizRule(), $params , $item ->getData()))
{
if (in_array( $itemName , $this ->defaultRoles))
return true;
if (isset( $assignments [ $itemName ]))
{
$assignment = $assignments [ $itemName ];
if ( $this ->executeBizRule( $assignment ->getBizRule(), $params , $assignment ->getData()))
return true;
}
$parents = $this ->db->createCommand()
->select( 'parent' )
->from( $this ->itemChildTable)
->where( 'child=:name' , array ( ':name' => $itemName ))
->queryColumn();
foreach ( $parents as $parent )
{
if ( $this ->checkAccessRecursive( $parent , $userId , $params , $assignments ))
return true;
}
}
return false;
}
|
7. CAuthManager验证权限
1
2
3
4
|
public function executeBizRule( $bizRule , $params , $data )
{
return $bizRule === '' || $bizRule ===null || ( $this ->showErrors ? eval ( $bizRule )!=0 : @ eval ( $bizRule )!=0);
}
|
8. 总是充许访问规则设置
希望本文所述对大家基于Yii框架的PHP程序设计有所帮助。