Controling client access is a problem that developers who developed a B / S-based architecture must consider.
The JSP or Servlet specification based on the configuration file-based security policy is based on files, ie, only one view can be defined or all cannot be accessed. A more complex system often requires part of the view (such as
A button in the JSP page provides access control, allowing only user access to a role. If a programmable security policy is used, because the definition of user roles and operations cannot be defined when developing, and this strategy has increased the programmer's workload, it may not be a good way.
I use custom labels and and configuration files to solve this problem: control the right to control
JSP page elements such as Button, as the content of the label. Get a unique name for protected content, using this name as an attribute of the label. A role has permissions to a page element or a set of page elements, described in the XML configuration file.
For example, below
The JSP page has "Details" and "Modify" two buttons.
<% @ Taglib URI =
"http:// mytag
"Prefix =
Custtag
"%>
test </ title></p>
<p></ hEAD></p>
<p><body></p>
<p><form name =</p>
<p>"Form1</p>
<p>"></p>
<p><Table Width =</p>
<p>"600</p>
<p>"Border =</p>
<p>"0</p>
<p>"Cellspacing =</p>
<p>"0</p>
<p>"Cellpadding =</p>
<p>"2</p>
<p>"></p>
<p><tr></p>
<p><TD></p>
<p><CustTag:</p>
<p>Jspsecurity ElementName =</p>
<p>Employeedetail</p>
<p>"></p>
<p><Input Type =</p>
<p>"Button</p>
<p>"Name =</p>
<p>"detail</p>
<p>"</p>
<p>Value =</p>
<p>"detailed</p>
<p>"></p>
<p></ custtag:</p>
<p>Jspsecurity></p>
<p><CustTag:</p>
<p>Jspsecurity ElementName =</p>
<p>Employeemodify</p>
<p>"></p>
<p><Input Type =</p>
<p>"Button</p>
<p>"Name =</p>
<p>"MODIFY</p>
<p>"</p>
<p>Value =</p>
<p>"modify</p>
<p>"></p>
<p></ custtag:</p>
<p>Jspsecurity></p>
<p></ td></p>
<p></ TR></p>
<p></ TABLE></p>
<p><br></p>
<p></ form></p>
<p></ body></p>
<p>The following XML configuration file content represents a user who is a Common, only the "Detailed" button named Employeedetail, which is permission, the role "admin", the page element named Employeedetail and Employeemodify is two The button has permission.</p>
<p><? XML Version =</p>
<p>"1.0</p>
<p>"ENCoding =</p>
<p>"GB2312</p>
<p>"?></p>
<p><security></p>
<p><HTMLELEMENT NAME =</p>
<p>Employeedetail</p>
<p>"></p>
<p><ROLENAME NAME =</p>
<p>"Common</p>
<p>"/></p>
<p><ROLENAME NAME =</p>
<p>ADMIN</p>
<p>"/> </ Htmlelement></p>
<p><HTMLELEMENT NAME =</p>
<p>Employeemodify</p>
<p>"></p>
<p><ROLENAME NAME =</p>
<p>ADMIN</p>
<p>"/></p>
<p></ htmlelement></p>
<p></ security></p>
<p>Custom label</p>
<p>JspsecurityTAG inherits the Bodytagsupport class. Bodytagsupport has a variable bodycontent pointing between the starting flag and the end flag.</p>
<p>JSPSecurityTag's private static variable RoleList saves the corresponding set of roles and page elements from the XML file, the name of the private variable ElementName corresponds to the name of the page element. When parsing the custom label, first take the name of the page element, then take the role of the current user, if the character has the permissions of the page element, the tag body (ie, the page element) is displayed, otherwise it is not displayed.</p>
<p>Pagekage com.presentation.view .view .view.Viewhelper.</p>
<p>Jspsecuritytag;</p>
<p>Import javax.servlet.</p>
<p>Jsp.tagext. *;</p>
<p>Import javax.servlet.</p>
<p>JSP. *;</p>
<p>Import java.util. *;</p>
<p>Import org.xml.sax. *;</p>
<p>Import org.xml.sax.helpers. *;</p>
<p>Import org.w3c.dom. *;</p>
<p>Import java.io. *;</p>
<p>Import javax.xml.parsers. *;</p>
<p>Public class</p>
<p>JspsecurityTag Extends Bodytagsupport {</p>
<p>/ / Save correspondence from the XML file to the role and page elements</p>
<p>Private static arraylist rolelist;</p>
<p>// Name of page elements</p>
<p>PRIVATE STRING ElementName;</p>
<p>Public void setElementName (String STR)</p>
<p>{</p>
<p>This.ElementName = STR;</p>
<p>}</p>
<p>Public int dressboDy () throws</p>
<p>JSPEXCEPTION {</p>
<p>IF (RoleList == Null)</p>
<p>{</p>
<p>RoleList = getList ();</p>
<p>}</p>
<p>Try {</p>
<p>/ / If the authentication is displayed, it will be as simple as the label body.</p>
<p>IF (isauthenticated (ElementName))</p>
<p>{</p>
<p>IF (BodyContent! = null) {</p>
<p>Jspwriter out = bodycontent.getenclosingwriter ();</p>
<p>BodyContent.writeout (out);</p>
<p>Else</p>
<p>{</p>
<p>}</p>
<p>}</p>
<p>} catch (exception e) {</p>
<p>Throw new</p>
<p>JSPEXCEPTION ();</p>
<p>}</p>
<p>Return Skip_body;</p>
<p>}</p>
<p>// Take the corresponding role and page elements from the XML configuration file, save to static arraylist</p>
<p>Private arraylist getList ()</p>
<p>{</p>
<p>DocumentBuilderFactory DBF =</p>
<p>DocumentBuilderFactory.newInstance ();</p>
<p>DocumentBuilder DB = NULL;</p>
<p>Document Doc = NULL;</p>
<p>Nodelist childlist = NULL;</p>
<p>String elementname;</p>
<p>String rolename;</p>
<p>Int index;</p>
<p>Arraylist thelist ();</p>
<p>Try {</p>
<p>DB = dbf.new</p>
<p>DocumentBuilder ();} catch (Exception E)</p>
<p>{</p>
<p>E.PrintStackTrace ();</p>
<p>}</p>
<p>Try {</p>
<p>DOC = db.parse (New file</p>
<p>SECURITY.XML</p>
<p>"));</p>
<p>} catch (Exception E)</p>
<p>{</p>
<p>E.PrintStackTrace ();</p>
<p>}</p>
<p>// Read page elements list</p>
<p>Nodelist elementlist = doc.getElementsBytagname</p>
<p>HTMLELEMENT</p>
<p>");</p>
<p>For (int i = 0; I <elementlist.getlength (); i )</p>
<p>{</p>
<p>Element name = (Element) ElementList.Item (i));</p>
<p>// Name of page elements</p>
<p>ElementName = Name.GetaTRibute</p>
<p>"Name</p>
<p>");</p>
<p>// This page element corresponds to a list of permissions</p>
<p>Nodelist rolnodelist = ((nodelist) Name.GetElementsBytagname</p>
<p>RoleName</p>
<p>"));</p>
<p>For (int J = 0; j <rolnodelist.getLength (); J )</p>
<p>{</p>
<p>// Name of the role with permissions</p>
<p>// ROLENAME = ((Element) Rolnodelist.Item (j)). getnode</p>
<p>Value ();</p>
<p>ROLENAME = (Element) Rolnodelist.Item (j)). GetAttribute (</p>
<p>"Name</p>
<p>");</p>
<p>Thelist.add (New ElementAndrole (ElementName, RoleName);</p>
<p>}</p>
<p>}</p>
<p>Return thelist;</p>
<p>}</p>
<p>/ / Check if the role has the permission of the page element</p>
<p>Private Boolean isauthentificated (String ElementName)</p>
<p>{</p>
<p>String rolename =</p>
<p>"</p>
<p>"</p>
<p>// Save the role of the user to the session when the user logs in, here is only used directly from the session.</p>
<p>Rolename = this.pageContext.getations (). getAttribute (</p>
<p>"ROLENAME");</p>
<p>// RoleList contains the ELEMENTNAME attribute as the // ElementAndrole object with the ROLENAME, the role is the permission of the page element.</p>
<p>IF (New ElementAndrole (ElementName, RoleName)))))</p>
<p>{</p>
<p>Return True;</p>
<p>}</p>
<p>}</p>
<p>Return False;</p>
<p>}</p>
<p>/ / Indicate the internal class of the corresponding relationship of the role and page elements</p>
<p>Class ElementAndrole {</p>
<p>String elementname;</p>
<p>String rolename;</p>
<p>Public ElementAndrole (String ElementName, String Rolename)</p>
<p>{</p>
<p>this.ElementName = ElementName;</p>
<p>this.RoleName = ROLENAME;</p>
<p>}</p>
<p>Public Boolean Equals (Object Obj)</p>
<p>{</p>
<p>Return ((ElementAndrole) .ElementName.Equals (this.ElementName) && ((ElementAndrole) Obj). RoleName.Equals (this.roleName));</p>
<p>}</p>
<p>}</p>
<p>}</p>
<p>In label library</p>
<p>Before using the JSP page, do three steps below, in</p>
<p>A Taglib element is included in the JSP page that determines the label library that needs to be loaded into the memory. front</p>
<p>The first line of the JSP file: <% @ Taglib URI =</p>
<p>"http:// mytag</p>
<p>"Prefix =</p>
<p>Custtag</p>
<p>"%> Is what this is.</p>
<p>2. Use the Taglib element to determine the location of the TLD file in the configuration file web.xml. Added in Web.xml:</p>
<p><taglib></p>
<p><taglib-uri></p>
<p>http: // mytag <; / taglib-uri></p>
<p><taglib-location></p>
<p>/Web-inf/mytag.tld</p>
<p></ taglib-location></p>
<p></ taglib></p>
<p>3, the TLD file must use the Taglib element to identify each custom label extreme attribute.</p>
<p>Here is the TLD file corresponding to this label library.</p>
<p><? XML Version =</p>
<p>"1.0</p>
<p>"ENCoding =</p>
<p>"ISO-8859-1</p>
<p>"?></p>
<p>DOCTYPE TAGLIB</p>
<p>Public</p>
<p>"- // Sun microsystems, inc .//dtd</p>
<p>JSP Tag Library 1.1 // en</p>
<p>"</p>
<p>"http://java.sun.com/j2ee/dtds/web-</p>
<p>JSptaglibrary_1_1.dtd</p>
<p>"></p>
<p><taglib></p>
<p><Tlibversion> 1.0 </ TLIBVERSION></p>
<p><</p>
<p>JSPVERSION> 1.1 </</p>
<p>JSPVersion></p>
<p><ShortName> MyTag </ ShortName></p>
<p><URI /></p>
<p><tag></p>
<p><Name></p>
<p>JSPSecurity </ name></p>
<p><tagclass> com.presentation.viewhlper.</p>
<p>JSPSecurityTag </ tagclass></p>
<p><info></p>
<p>Jspsecuritytag</p>
<p></ info></p>
<p><Attribute></p>
<p><name> ElementName </ Name></p>
<p><required> True </ reguired></p>
<p><RTEXPR</p>
<p>Value> True </ RTEXPR</p>
<p>Value></p>
<p></ attribute></p>
<p></ tag></p>
<p></ taglib></p></div><div class="text-center mt-3 text-grey">
转载请注明原文地址:https://www.9cbs.com/read-73940.html</div><div class="plugin d-flex justify-content-center mt-3"></div><hr><div class="row"><div class="col-lg-12 text-muted mt-2"><i class="icon-tags mr-2"></i><span class="badge border border-secondary mr-2"><h2 class="h6 mb-0 small"><a class="text-secondary" href="tag-2.html">9cbs</a></h2></span></div></div></div></div><div class="card card-postlist border-white shadow"><div class="card-body"><div class="card-title"><div class="d-flex justify-content-between"><div><b>New Post</b>(<span class="posts">0</span>)
</div><div></div></div></div><ul class="postlist list-unstyled">
</ul></div></div><div class="d-none threadlist"><input type="checkbox" name="modtid" value="73940" checked /></div></div></div></div></div><footer class="text-muted small bg-dark py-4 mt-3" id="footer"><div class="container"><div class="row"><div class="col">CopyRight © 2020 All Rights Reserved
</div><div class="col text-right">Processed:
<b>0.033</b>, SQL:
<b>9</b></div></div></div></footer><script src="./lang/en-us/lang.js?2.2.0"></script><script src="view/js/jquery.min.js?2.2.0"></script><script src="view/js/popper.min.js?2.2.0"></script><script src="view/js/bootstrap.min.js?2.2.0"></script><script src="view/js/xiuno.js?2.2.0"></script><script src="view/js/bootstrap-plugin.js?2.2.0"></script><script src="view/js/async.min.js?2.2.0"></script><script src="view/js/form.js?2.2.0"></script><script>
var debug = DEBUG = 0;
var url_rewrite_on = 1;
var url_path = './';
var forumarr = {"1":"Tech"};
var fid = 1;
var uid = 0;
var gid = 0;
xn.options.water_image_url = 'view/img/water-small.png';
</script><script src="view/js/wellcms.js?2.2.0"></script><a class="scroll-to-top rounded" href="javascript:void(0);"><i class="icon-angle-up"></i></a><a class="scroll-to-bottom rounded" href="javascript:void(0);" style="display: inline;"><i class="icon-angle-down"></i></a></body></html><script>
var forum_url = 'list-1.html';
var safe_token = 'G7AFGBwqcRUhJ82nnOc5zwwE64r7MeQAcsiJuIdmsYd8AsqDYn_2B5RBdot1s2nzhECFaXWiWir2Q5TlvqAnj1mg_3D_3D';
var body = $('body');
body.on('submit', '#form', function() {
var jthis = $(this);
var jsubmit = jthis.find('#submit');
jthis.reset();
jsubmit.button('loading');
var postdata = jthis.serializeObject();
$.xpost(jthis.attr('action'), postdata, function(code, message) {
if(code == 0) {
location.reload();
} else {
$.alert(message);
jsubmit.button('reset');
}
});
return false;
});
function resize_image() {
var jmessagelist = $('div.message');
var first_width = jmessagelist.width();
jmessagelist.each(function() {
var jdiv = $(this);
var maxwidth = jdiv.attr('isfirst') ? first_width : jdiv.width();
var jmessage_width = Math.min(jdiv.width(), maxwidth);
jdiv.find('img, embed, iframe, video').each(function() {
var jimg = $(this);
var img_width = this.org_width;
var img_height = this.org_height;
if(!img_width) {
var img_width = jimg.attr('width');
var img_height = jimg.attr('height');
this.org_width = img_width;
this.org_height = img_height;
}
if(img_width > jmessage_width) {
if(this.tagName == 'IMG') {
jimg.width(jmessage_width);
jimg.css('height', 'auto');
jimg.css('cursor', 'pointer');
jimg.on('click', function() {
});
} else {
jimg.width(jmessage_width);
var height = (img_height / img_width) * jimg.width();
jimg.height(height);
}
}
});
});
}
function resize_table() {
$('div.message').each(function() {
var jdiv = $(this);
jdiv.find('table').addClass('table').wrap('<div class="table-responsive"></div>');
});
}
$(function() {
resize_image();
resize_table();
$(window).on('resize', resize_image);
});
var jmessage = $('#message');
jmessage.on('focus', function() {if(jmessage.t) { clearTimeout(jmessage.t); jmessage.t = null; } jmessage.css('height', '6rem'); });
jmessage.on('blur', function() {jmessage.t = setTimeout(function() { jmessage.css('height', '2.5rem');}, 1000); });
$('#nav li[data-active="fid-1"]').addClass('active');
</script>
