授权属性不使用角色MVC C＃

Question

我正在修改用C＃MVC编写的系统。

我刚刚在管理员区域内建立了额外的功能，允许管理员创建具有有限管理员功能的用户帐户。我已经把以下在每个控制器的新功能：

[Authorize(Roles = "Administrator")] 

不过，如果我登录使用受限管理员帐户，并导航到这个页面，它让我通过。

我很难过，因为我似乎正在做这个正确的方式，但我也是相当新的MVC，有什么我可以检查？我没有改变任何web.config文件，所以应该没问题。

我知道上面的信息有限，没有寻找现成的解决方案，更多关于我可以检查以纠正问题的建议。

感谢

编辑：

这是新的角色/账号是如何产生的。也很容易，这是第一次尝试，没有太多验证。

[Authorize(Roles = "Administrator")] 
    [HttpPost] 
    public ActionResult AddSalesManager(App.Web.Areas.Administrator.Models.SalesManager model, FormCollection formValues) 
    { 
     if (formValues["Cancel"] != null) 
     { 
      return RedirectToAction("Index"); 
     } 

     if (!string.Equals(model.password, model.confirmpassword)) 
     { 
      ModelState.AddModelError("password", "Password and Confirmation must match"); 
     } 

     if (ModelState.IsValid) 
     { 
      using (ModelContainer ctn = new ModelContainer()) 
      { 
       // First, create the user account inside the ASP.Net membership system. 
       // 

       Membership.ApplicationName = "App"; 
       Roles.ApplicationName = "App"; 

       if (!Roles.RoleExists("LimitedAdmin")) 
        Roles.CreateRole("LimitedAdmin"); 

       // MembershipCreateStatus createStatus = MembershipService.CreateUser(model.email, model.password, model.email); 
       if (Membership.GetUser(model.email) == null) 
       { 
        Membership.CreateUser(model.email, model.password); 
        Roles.AddUserToRole(model.email, "LimitedAdmin"); 
       } 

      } 
     } 
     return RedirectToAction("Index"); 

    } 

Answer 1

您对此代码有什么期待？

使用此属性，您将获得管理员角色中的所有用户执行此控制器操作的权限，无论该帐户的限制如何。

Answer 2

角色属性

[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, Inherited = true, AllowMultiple = false)] 
public class PermissionsAttribute : ActionFilterAttribute 
{ 
    private readonly PermissionsType required; 

    public PermissionsAttribute() 
    { 
    } 

    public PermissionsAttribute(PermissionsType required) 
    { 
     this.required = required; 
    } 

    public override void OnActionExecuting(ActionExecutingContext filterContext) 
    { 
     // Log("OnActionExecuting", filterContext.RouteData); 

     HttpSessionStateBase session = filterContext.HttpContext.Session; 
     Controller controller = filterContext.Controller as Controller; 

     //This is uesd to redirect to same controller but differnect action 
     // controller.HttpContext.Response.Redirect("./Login"); 

     var rjasthan = filterContext; 


     var URK = filterContext.HttpContext.Request.RawUrl; 
     if (session["UserPermissions"] != null) 
     { 
      if (!CheckPermissions((UserPermission)session["UserPermissions"])) 
      { 
       // this is used to signout from sesssion 
       // filterContext.HttpContext.GetOwinContext().Authentication.SignOut(); 

       filterContext.Controller.TempData["AuthenticationMessages"] = "You are not authorized to access"; 

       filterContext.Result = new RedirectToRouteResult(new RouteValueDictionary{ 
          { "controller", "Home" },{ "action", "UnAuthorizeAccess" }}); 

      } 
     } 

     base.OnActionExecuting(filterContext); 

    } 

    protected bool CheckPermissions(UserPermission model) 
    { 
     bool result = false; 

     if (this.required == (PermissionsType.Add)) 
     { 
      if (model.AddRight) 
       result = true; 
     } 
     else if (this.required == (PermissionsType.View)) 
     { 
      if (model.ViewRight) 
       result = true; 
     } 
     else if (this.required == (PermissionsType.Edit)) 
     { 
      if (model.EditRight) 
       result = true; 
     } 
     else if (this.required == (PermissionsType.Delete)) 
     { 
      if (model.DeleteRight) 
       result = true; 
     } 
     else if (this.required == (PermissionsType.View | PermissionsType.Edit)) 
     { 
      if (model.ViewRight && model.EditRight) 
      { 
       result = true; 
      } 
     } 
     else if (this.required == (PermissionsType.Add | PermissionsType.Edit)) 
     { 
      if (model.AddRight && model.EditRight) 
      { 
       result = true; 
      } 
     } 


     return result; 
    } 

    private void Log(string methodName, RouteData routeData) 
    { 
     var controllerName = routeData.Values["controller"]; 
     var actionName = routeData.Values["action"]; 
     var message = String.Format("{0} controller:{1} action:{2}", methodName, controllerName, actionName); 
     Debug.WriteLine(message, "Action Filter Log"); 
    } 
} 

[Flags] 
public enum PermissionsType 
{ 
    View = (1 << 0), 
    Add = (1 << 1), 
    Edit = (1 << 2), 
    Delete = (1 << 3), 
    Admin = (View | Add | Edit | Delete) 
} 



[Permissions(PermissionsType.Add)] 
    public ActionResult Register() 
    { 
     return this.AjaxableView(); 
    }