懒人的简单权限管理 （基于Struts）

网站没什么很复杂的权限控制，用户分几个等级。我使用了一个最懒的实现方式，不同等级的页面规定的ServletPath都以不同的开头来标示。打个比方,${pageContext.request.contextPath}/public/xx.do任何人都可以进入,${pageContext.request.contextPath}/contracted/xx.do只能是登录用户可以进入等等..

public class MyRequestProcessor extends RequestProcessor {
	public void process(HttpServletRequest request, HttpServletResponse response)
			throws IOException, ServletException {

		 try {
		super.process(request, response);
		 } finally {
		 }
                  //这里可以做N多的事情，比如如果用JDO，可以在这里确保pm被关闭，context被释放等等。。
	}
        
	protected boolean processRoles(HttpServletRequest request,
			HttpServletResponse response, ActionMapping mapping)
			throws IOException, ServletException {
		String path = request.getServletPath();
		if (path.startsWith("/public"))
			return true;
		if (!authenticate(request, response, mapping))
			return false;
		return authorize(request, response, mapping);
	}
        
	public boolean authenticate(HttpServletRequest request,
			HttpServletResponse response, ActionMapping mapping)
			throws IOException, ServletException {
		UserVO user = PrizoneUtil.getCurrentUser(request);
		if (user != null) {
			return true;
		} else {
			ForwardConfig forwardConfig = moduleConfig.findForwardConfig("登陆Forward");
			if (forwardConfig == null) {
				throw new ServletException("登陆页面配制错误");
			}
			this.processForwardConfig(request, response, forwardConfig);
			return false;
		}
	}

	public boolean authorize(HttpServletRequest request,
			HttpServletResponse response, ActionMapping mapping)
			throws IOException, ServletException {

		UserVO user = request.getSession().getAttribute("User");
		String path = request.getServletPath();
		if (path.startsWith("/contracted")
				&& (Constants.USER_ROLE_NORMAL.equals(user.getRole())
						|| Constants.USER_ROLE_VIP.equals(user.getRole())
						|| Constants.USER_ROLE_NET_MASTER
								.equals(user.getRole()) || Constants.USER_ROLE_ADMINISTRATOR
						.equals(user.getRole()))) {
			return true;
		} else if (path.startsWith("/protected")
				&& (Constants.USER_ROLE_NET_MASTER.equals(user.getRole()) || Constants.USER_ROLE_ADMINISTRATOR
						.equals(user.getRole()))) {
			return true;
		} else if (path.startsWith("/private")
				&& Constants.USER_ROLE_ADMINISTRATOR.equals(user.getRole())) {
			return true;
		} else {
			ForwardConfig forwardConfig = moduleConfig
					.findForwardConfig("xxx");
			if (forwardConfig == null) {
				throw new ServletException("xxx page is not defined");
			}
			this.processForwardConfig(request, response, forwardConfig);
			return false;
		}
	}
}

然后在struts-config.xml里配制一下

<controller processorClass="com.tianhui.web.action.MyRequestProcessor" nocache="true" />