通过django默认的权限管理来管理权限即可,我们在基础上进行一些第三方扩展
下面给出一个权限控制的示例,这里url路径转发的时候需要添加默认的 别名,我们需要修改的也是这些别名
models.py
classUserProfile(models.Model):user=models.OneToOneField(User)name=models.CharField(max_length=64)school=models.ForeignKey('School')def__unicode__(self):returnself.nameclassMeta:permissions=(('view_customer_list',u'可以查看客户列表'),('view_customer_info',u'可以查看客户详情'),('edit_own_customer_info',u'可以修改自己的客户信息'),('view_teacher_list',u'可以查看老师列表'),('view_school_list',u'可以查看学校列表'),)permissions.py 这边采取的是装饰的写法
#-*-coding:utf-8-*-#Author:AlexLifromdjango.core.urlresolversimportresolvefromdjango.shortcutsimportrenderperm_dic={'view_customer_list':['customer_list','GET',[]],'view_customer_info':['customer_detail','GET',[]],'''''''''后端参数''''edit_own_customer_info':['customer_detail','POST',[]],}defperm_check(*args,**kwargs):request=args[0]url_resovle_obj=resolve(request.path_info)current_url_namespace=url_resovle_obj.url_name#app_name=url_resovle_obj.app_name#usethisnamelaterprint('urlnamespace:',current_url_namespace)matched_flag=False#findmatchedpermitemmatched_perm_key=Noneifcurrent_url_namespaceisnotNone:#ifdidn'tsettheurlnamespace,permissiondoesn'tworkprint('findperm...')forperm_keyinperm_dic:perm_val=perm_dic[perm_key]iflen(perm_val)==3:#otherwiseinvalidpermdataformaturl_namespace,request_method,request_args=perm_valprint(url_namespace,current_url_namespace)ifurl_namespace==current_url_namespace:#matchedtheurlifrequest.method==request_method:#matchedrequestmethodifnotrequest_args:#ifempty,passmatched_flag=Truematched_perm_key=perm_keyprint('mtched...')break#noneedlookingforotherpermselse:forrequest_arginrequest_args:#mighthasmanyargsrequest_method_func=getattr(request,request_method)#getorpostmostly#print('----->>>',request_method_func.get(request_arg))ifrequest_method_func.get(request_arg)isnotNone:matched_flag=True#thearginsetinpermitemmustbeprovidedinrequestdataelse:matched_flag=Falseprint('requestarg[%s]notmatched'%request_arg)break#noneedgofurtherifmatched_flag==True:#meanspassedpermissioncheck,noneedcheckothersprint('--passedpermissioncheck--')matched_perm_key=perm_keybreakelse:#permissiondoesn'twork'''这边如果没有定义url别名的话,那么为了避免影响全局,就让它默认就有权限'''returnTrueifmatched_flag==True:#passpermissioncheckperm_str='crm.%s'%(matched_perm_key)#crm.view_customer_listifrequest.user.has_perm(perm_str):print('\033[42;1m--------passedpermissioncheck----\033[0m')returnTrueelse:print('\033[41;1m-----nopermission----\033[0m')print(request.user,perm_str)returnFalseelse:print('\033[41;1m-----nomatchedpermission----\033[0m')'''所有的为空的情况,也没有放过'''returnFalsedefcheck_permission(func):defwrapper(*args,**kwargs):print('---startcheckperm---')ifperm_check(*args,**kwargs)isnotTrue:#nopermisssionreturnrender(args[0],'crm/403.html')returnfunc(*args,**kwargs)returnwrapperviews.py
'''这块也在前端做了下权限划分的显示,成功了'''@login_required@check_permissiondefteachers(req):teachers_list=models.UserProfile.objects.all()returnrender(req,'crm/teachers.html',{'teachers_list':teachers_list})◆ 权限验证(1)
views 中验证
◆ 权限验证(2)
Template 中的权限检查
前端权限判断截图如下:
通过django默认的权限管理来管理权限即可,我们在基础上进行一些第三方扩展
下面给出一个权限控制的示例,这里url路径转发的时候需要添加默认的 别名,我们需要修改的也是这些别名
models.py
classUserProfile(models.Model):user=models.OneToOneField(User)name=models.CharField(max_length=64)school=models.ForeignKey('School')def__unicode__(self):returnself.nameclassMeta:permissions=(('view_customer_list',u'可以查看客户列表'),('view_customer_info',u'可以查看客户详情'),('edit_own_customer_info',u'可以修改自己的客户信息'),('view_teacher_list',u'可以查看老师列表'),('view_school_list',u'可以查看学校列表'),)permissions.py 这边采取的是装饰的写法
#-*-coding:utf-8-*-#Author:AlexLifromdjango.core.urlresolversimportresolvefromdjango.shortcutsimportrenderperm_dic={'view_customer_list':['customer_list','GET',[]],'view_customer_info':['customer_detail','GET',[]],'''''''''后端参数''''edit_own_customer_info':['customer_detail','POST',[]],}defperm_check(*args,**kwargs):request=args[0]url_resovle_obj=resolve(request.path_info)current_url_namespace=url_resovle_obj.url_name#app_name=url_resovle_obj.app_name#usethisnamelaterprint('urlnamespace:',current_url_namespace)matched_flag=False#findmatchedpermitemmatched_perm_key=Noneifcurrent_url_namespaceisnotNone:#ifdidn'tsettheurlnamespace,permissiondoesn'tworkprint('findperm...')forperm_keyinperm_dic:perm_val=perm_dic[perm_key]iflen(perm_val)==3:#otherwiseinvalidpermdataformaturl_namespace,request_method,request_args=perm_valprint(url_namespace,current_url_namespace)ifurl_namespace==current_url_namespace:#matchedtheurlifrequest.method==request_method:#matchedrequestmethodifnotrequest_args:#ifempty,passmatched_flag=Truematched_perm_key=perm_keyprint('mtched...')break#noneedlookingforotherpermselse:forrequest_arginrequest_args:#mighthasmanyargsrequest_method_func=getattr(request,request_method)#getorpostmostly#print('----->>>',request_method_func.get(request_arg))ifrequest_method_func.get(request_arg)isnotNone:matched_flag=True#thearginsetinpermitemmustbeprovidedinrequestdataelse:matched_flag=Falseprint('requestarg[%s]notmatched'%request_arg)break#noneedgofurtherifmatched_flag==True:#meanspassedpermissioncheck,noneedcheckothersprint('--passedpermissioncheck--')matched_perm_key=perm_keybreakelse:#permissiondoesn'twork'''这边如果没有定义url别名的话,那么为了避免影响全局,就让它默认就有权限'''returnTrueifmatched制作软件_flag==True:#passpermissioncheckperm_str='crm.%s'%(matched_perm_key)#crm.view_customer_listifrequest.user.has_perm(perm_str):print('\033[42;1m--------passedpermissioncheck----\033[0m')returnTrueelse:print('\033[41;1m-----nopermission----\033[0m')print(request.user,perm_str)returnFalseelse:print('\033[41;1m-----nomatchedpermission----\033[0m')'''所有的为空的情况,也没有放过'''returnFalsedefcheck_permission(func):defwrapper(*args,**kwargs):print('---startcheckperm---')ifperm_check(*args,**kwargs)isnotTrue:#nopermisssionreturnrender(args[0],'crm/403.html')returnfunc(*args,**kwargs)returnwrapperviews.py
'''这块也在前端做了下权限划分的显示,成功了'''@login_required@check_permissiondefteachers(req):teachers_list=models.UserProfile.objects.all()returnrender(req,'crm/teachers.html',{'teachers_list':teachers_list})◆ 权限验证(1)
views 中验证
◆ 权限验证(2)
Template 中的权限检查
前端权限判断截图如下: