From 83964bfa78385914c32d922ed2aa7081b16160c1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E4=B8=8D=E8=83=9C=E8=88=9F?= <1650473152@qq.com> Date: Wed, 28 Dec 2022 01:38:40 +0800 Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E6=94=B9=E9=89=B4=E6=9D=83=E9=80=BB?= =?UTF-8?q?=E8=BE=91=20-->=20=20=E7=AE=A1=E7=90=86=E5=91=98=E8=8E=B7?= =?UTF-8?q?=E5=BE=97=E8=AE=BF=E9=97=AE=E5=85=A8=E9=83=A8=E6=9D=83=E9=99=90?= =?UTF-8?q?=E7=99=BD=E5=90=8D=E5=8D=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- applications/common/admin.py | 13 ------------- applications/common/utils/rights.py | 3 +++ applications/view/admin/dict.py | 4 ++-- applications/view/admin/file.py | 4 ++-- applications/view/admin/mail.py | 19 +++++++++---------- applications/view/admin/monitor.py | 2 +- applications/view/admin/power.py | 4 ++-- applications/view/admin/role.py | 4 ++-- applications/view/admin/user.py | 13 ++++++++++--- applications/view/passport/__init__.py | 19 +++++++++++++++++-- 10 files changed, 48 insertions(+), 37 deletions(-) diff --git a/applications/common/admin.py b/applications/common/admin.py index 0958316..3d66369 100644 --- a/applications/common/admin.py +++ b/applications/common/admin.py @@ -8,19 +8,6 @@ from applications.common.utils.gen_captcha import vieCode from applications.schemas import PowerOutSchema -# 授权路由存入session -def add_auth_session(): - role = current_user.role - user_power = [] - for i in role: - if i.enable == 0: - continue - for p in i.power: - if p.enable == 0: - continue - user_power.append(p.code) - session['permissions'] = user_power - # 生成菜单树 def make_menu_tree(): diff --git a/applications/common/utils/rights.py b/applications/common/utils/rights.py index 0243872..655593f 100644 --- a/applications/common/utils/rights.py +++ b/applications/common/utils/rights.py @@ -9,6 +9,9 @@ def authorize(power: str, log: bool = False): @login_required @wraps(func) def wrapper(*args, **kwargs): + # 定义管理员的id为1 + if 1 in session.get('role')[0]: + return func(*args, **kwargs) if not power in session.get('permissions'): if log: admin_log(request=request, is_access=False) diff --git a/applications/view/admin/dict.py b/applications/view/admin/dict.py index 9818590..bfbd47b 100644 --- a/applications/view/admin/dict.py +++ b/applications/view/admin/dict.py @@ -14,13 +14,13 @@ admin_dict = Blueprint('adminDict', __name__, url_prefix='/admin/dict') # 数据字典 @admin_dict.get('/') -@authorize("admin:dict:main", log=True) +@authorize("admin:dict:main") def main(): return render_template('admin/dict/main.html') @admin_dict.get('/dictType/data') -@authorize("admin:dict:main", log=True) +@authorize("admin:dict:main") def dict_type_data(): # 获取请求参数 type_name = str_escape(request.args.get('typeName', type=str)) diff --git a/applications/view/admin/file.py b/applications/view/admin/file.py index 8e45420..98c658d 100644 --- a/applications/view/admin/file.py +++ b/applications/view/admin/file.py @@ -12,14 +12,14 @@ admin_file = Blueprint('adminFile', __name__, url_prefix='/admin/file') # 图片管理 @admin_file.get('/') -@authorize("admin:file:main", log=True) +@authorize("admin:file:main") def index(): return render_template('admin/photo/photo.html') # 图片数据 @admin_file.get('/table') -@authorize("admin:file:main", log=True) +@authorize("admin:file:main") def table(): page = request.args.get('page', type=int) limit = request.args.get('limit', type=int) diff --git a/applications/view/admin/mail.py b/applications/view/admin/mail.py index eafe1e2..e0e2668 100644 --- a/applications/view/admin/mail.py +++ b/applications/view/admin/mail.py @@ -1,12 +1,11 @@ from flask import Blueprint, render_template, request, current_app from flask_login import current_user from flask_mail import Message - from applications.common.curd import model_to_dicts from applications.common.helper import ModelFilter from applications.common.utils.http import table_api, fail_api, success_api from applications.common.utils.rights import authorize -from applications.common.utils.validate import xss_escape +from applications.common.utils.validate import str_escape from applications.extensions import db, flask_mail from applications.models import Mail from applications.schemas import MailOutSchema @@ -16,19 +15,19 @@ admin_mail = Blueprint('adminMail', __name__, url_prefix='/admin/mail') # 用户管理 @admin_mail.get('/') -@authorize("admin:mail:main", log=True) +@authorize("admin:mail:main") def main(): return render_template('admin/mail/main.html') # 用户分页查询 @admin_mail.get('/data') -@authorize("admin:mail:main", log=True) +@authorize("admin:mail:main") def data(): # 获取请求参数 - receiver = xss_escape(request.args.get("receiver")) - subject = xss_escape(request.args.get('subject')) - content = xss_escape(request.args.get('content')) + receiver = str_escape(request.args.get("receiver")) + subject = str_escape(request.args.get('subject')) + content = str_escape(request.args.get('content')) # 查询参数构造 mf = ModelFilter() if receiver: @@ -56,9 +55,9 @@ def add(): @authorize("admin:mail:add", log=True) def save(): req_json = request.json - receiver = xss_escape(req_json.get("receiver")) - subject = xss_escape(req_json.get('subject')) - content = xss_escape(req_json.get('content')) + receiver = str_escape(req_json.get("receiver")) + subject = str_escape(req_json.get('subject')) + content = str_escape(req_json.get('content')) user_id = current_user.id try: diff --git a/applications/view/admin/monitor.py b/applications/view/admin/monitor.py index 32cf269..40f1e9e 100644 --- a/applications/view/admin/monitor.py +++ b/applications/view/admin/monitor.py @@ -12,7 +12,7 @@ admin_monitor_bp = Blueprint('adminMonitor', __name__, url_prefix='/admin/monito # 系统监控 @admin_monitor_bp.get('/') -@authorize("admin:monitor:main", log=True) +@authorize("admin:monitor:main") def main(): # 主机名称 hostname = platform.node() diff --git a/applications/view/admin/power.py b/applications/view/admin/power.py index 54de902..21f3a0b 100644 --- a/applications/view/admin/power.py +++ b/applications/view/admin/power.py @@ -12,13 +12,13 @@ admin_power = Blueprint('adminPower', __name__, url_prefix='/admin/power') @admin_power.get('/') -@authorize("admin:power:main", log=True) +@authorize("admin:power:main") def index(): return render_template('admin/power/main.html') @admin_power.post('/data') -@authorize("admin:power:main", log=True) +@authorize("admin:power:main") def data(): power = Power.query.all() res = { diff --git a/applications/view/admin/role.py b/applications/view/admin/role.py index f4781dc..d5c7928 100644 --- a/applications/view/admin/role.py +++ b/applications/view/admin/role.py @@ -13,14 +13,14 @@ admin_role = Blueprint('adminRole', __name__, url_prefix='/admin/role') # 用户管理 @admin_role.get('/') -@authorize("admin:role:main", log=True) +@authorize("admin:role:main") def main(): return render_template('admin/role/main.html') # 表格数据 @admin_role.get('/data') -@authorize("admin:role:main", log=True) +@authorize("admin:role:main") def table(): role_name = str_escape(request.args.get('roleName', type=str)) role_code = str_escape(request.args.get('roleCode', type=str)) diff --git a/applications/view/admin/user.py b/applications/view/admin/user.py index 18f962b..b5af8fe 100644 --- a/applications/view/admin/user.py +++ b/applications/view/admin/user.py @@ -1,4 +1,4 @@ -from flask import Blueprint, render_template, request +from flask import Blueprint, render_template, request, session from flask_login import login_required, current_user from sqlalchemy import desc @@ -16,14 +16,14 @@ admin_user = Blueprint('adminUser', __name__, url_prefix='/admin/user') # 用户管理 @admin_user.get('/') -@authorize("admin:user:main", log=True) +@authorize("admin:user:main") def main(): return render_template('admin/user/main.html') # 用户分页查询 @admin_user.get('/data') -@authorize("admin:user:main", log=True) +@authorize("admin:user:main") def data(): # 获取请求参数 real_name = str_escape(request.args.get('realName', type=str)) @@ -238,3 +238,10 @@ def batch_remove(): res = User.query.filter_by(id=id).delete() db.session.commit() return success_api(msg="批量删除成功") + + +@admin_user.get("test") +def test(): + print(session) + print(session.get('role')[0]) + return '6' diff --git a/applications/view/passport/__init__.py b/applications/view/passport/__init__.py index 3c18e50..371ef1f 100644 --- a/applications/view/passport/__init__.py +++ b/applications/view/passport/__init__.py @@ -60,8 +60,23 @@ def login_post(): login_user(user) # 记录登录日志 login_log(request, uid=user.id, is_access=True) - # 存入权限 - index_curd.add_auth_session() + # 授权路由存入session + role = current_user.role + user_power = [] + for i in role: + if i.enable == 0: + continue + for p in i.power: + if p.enable == 0: + continue + user_power.append(p.code) + session['permissions'] = user_power + # 角色存入session + roles = [] + for role in current_user.role.all(): + roles.append(role.id) + session['role'] = [roles] + return success_api(msg="登录成功") login_log(request, uid=user.id, is_access=False) return fail_api(msg="用户名或密码错误")