修改鉴权逻辑 --> 管理员获得访问全部权限白名单

applications/common/admin.py

@@ -8,19 +8,6 @@ from applications.common.utils.gen_captcha import vieCode
 from applications.schemas import PowerOutSchema
 
 
-# 授权路由存入session
-def add_auth_session():
-    role = current_user.role
-    user_power = []
-    for i in role:
-        if i.enable == 0:
-            continue
-        for p in i.power:
-            if p.enable == 0:
-                continue
-            user_power.append(p.code)
-    session['permissions'] = user_power
-
 
 # 生成菜单树
 def make_menu_tree():

applications/common/utils/rights.py

@@ -9,6 +9,9 @@ def authorize(power: str, log: bool = False):
         @login_required
         @wraps(func)
         def wrapper(*args, **kwargs):
+            # 定义管理员的id为1
+            if 1 in session.get('role')[0]:
+                return func(*args, **kwargs)
             if not power in session.get('permissions'):
                 if log:
                     admin_log(request=request, is_access=False)

applications/view/admin/dict.py

@@ -14,13 +14,13 @@ admin_dict = Blueprint('adminDict', __name__, url_prefix='/admin/dict')
 
 # 数据字典
 @admin_dict.get('/')
-@authorize("admin:dict:main", log=True)
+@authorize("admin:dict:main")
 def main():
     return render_template('admin/dict/main.html')
 
 
 @admin_dict.get('/dictType/data')
-@authorize("admin:dict:main", log=True)
+@authorize("admin:dict:main")
 def dict_type_data():
     # 获取请求参数
     type_name = str_escape(request.args.get('typeName', type=str))

applications/view/admin/file.py

@@ -12,14 +12,14 @@ admin_file = Blueprint('adminFile', __name__, url_prefix='/admin/file')
 
 #  图片管理
 @admin_file.get('/')
-@authorize("admin:file:main", log=True)
+@authorize("admin:file:main")
 def index():
     return render_template('admin/photo/photo.html')
 
 
 #  图片数据
 @admin_file.get('/table')
-@authorize("admin:file:main", log=True)
+@authorize("admin:file:main")
 def table():
     page = request.args.get('page', type=int)
     limit = request.args.get('limit', type=int)

applications/view/admin/mail.py

@@ -1,12 +1,11 @@
 from flask import Blueprint, render_template, request, current_app
 from flask_login import current_user
 from flask_mail import Message
-
 from applications.common.curd import model_to_dicts
 from applications.common.helper import ModelFilter
 from applications.common.utils.http import table_api, fail_api, success_api
 from applications.common.utils.rights import authorize
-from applications.common.utils.validate import xss_escape
+from applications.common.utils.validate import str_escape
 from applications.extensions import db, flask_mail
 from applications.models import Mail
 from applications.schemas import MailOutSchema
@@ -16,19 +15,19 @@ admin_mail = Blueprint('adminMail', __name__, url_prefix='/admin/mail')
 
 # 用户管理
 @admin_mail.get('/')
-@authorize("admin:mail:main", log=True)
+@authorize("admin:mail:main")
 def main():
     return render_template('admin/mail/main.html')
 
 
 #   用户分页查询
 @admin_mail.get('/data')
-@authorize("admin:mail:main", log=True)
+@authorize("admin:mail:main")
 def data():
     # 获取请求参数
-    receiver = xss_escape(request.args.get("receiver"))
+    receiver = str_escape(request.args.get("receiver"))
-    subject = xss_escape(request.args.get('subject'))
+    subject = str_escape(request.args.get('subject'))
-    content = xss_escape(request.args.get('content'))
+    content = str_escape(request.args.get('content'))
     # 查询参数构造
     mf = ModelFilter()
     if receiver:
@@ -56,9 +55,9 @@ def add():
 @authorize("admin:mail:add", log=True)
 def save():
     req_json = request.json
-    receiver = xss_escape(req_json.get("receiver"))
+    receiver = str_escape(req_json.get("receiver"))
-    subject = xss_escape(req_json.get('subject'))
+    subject = str_escape(req_json.get('subject'))
-    content = xss_escape(req_json.get('content'))
+    content = str_escape(req_json.get('content'))
     user_id = current_user.id
 
     try:

applications/view/admin/monitor.py

@@ -12,7 +12,7 @@ admin_monitor_bp = Blueprint('adminMonitor', __name__, url_prefix='/admin/monito
 
 # 系统监控
 @admin_monitor_bp.get('/')
-@authorize("admin:monitor:main", log=True)
+@authorize("admin:monitor:main")
 def main():
     # 主机名称
     hostname = platform.node()

applications/view/admin/power.py

@@ -12,13 +12,13 @@ admin_power = Blueprint('adminPower', __name__, url_prefix='/admin/power')
 
 
 @admin_power.get('/')
-@authorize("admin:power:main", log=True)
+@authorize("admin:power:main")
 def index():
     return render_template('admin/power/main.html')
 
 
 @admin_power.post('/data')
-@authorize("admin:power:main", log=True)
+@authorize("admin:power:main")
 def data():
     power = Power.query.all()
     res = {

applications/view/admin/role.py

@@ -13,14 +13,14 @@ admin_role = Blueprint('adminRole', __name__, url_prefix='/admin/role')
 
 # 用户管理
 @admin_role.get('/')
-@authorize("admin:role:main", log=True)
+@authorize("admin:role:main")
 def main():
     return render_template('admin/role/main.html')
 
 
 # 表格数据
 @admin_role.get('/data')
-@authorize("admin:role:main", log=True)
+@authorize("admin:role:main")
 def table():
     role_name = str_escape(request.args.get('roleName', type=str))
     role_code = str_escape(request.args.get('roleCode', type=str))

applications/view/admin/user.py

@@ -1,4 +1,4 @@
-from flask import Blueprint, render_template, request
+from flask import Blueprint, render_template, request, session
 from flask_login import login_required, current_user
 from sqlalchemy import desc
 
@@ -16,14 +16,14 @@ admin_user = Blueprint('adminUser', __name__, url_prefix='/admin/user')
 
 # 用户管理
 @admin_user.get('/')
-@authorize("admin:user:main", log=True)
+@authorize("admin:user:main")
 def main():
     return render_template('admin/user/main.html')
 
 
 #   用户分页查询
 @admin_user.get('/data')
-@authorize("admin:user:main", log=True)
+@authorize("admin:user:main")
 def data():
     # 获取请求参数
     real_name = str_escape(request.args.get('realName', type=str))
@@ -238,3 +238,10 @@ def batch_remove():
         res = User.query.filter_by(id=id).delete()
         db.session.commit()
     return success_api(msg="批量删除成功")
+
+
+@admin_user.get("test")
+def test():
+    print(session)
+    print(session.get('role')[0])
+    return '6'

applications/view/passport/__init__.py

@@ -60,8 +60,23 @@ def login_post():
         login_user(user)
         # 记录登录日志
         login_log(request, uid=user.id, is_access=True)
-        # 存入权限
+        # 授权路由存入session
-        index_curd.add_auth_session()
+        role = current_user.role
+        user_power = []
+        for i in role:
+            if i.enable == 0:
+                continue
+            for p in i.power:
+                if p.enable == 0:
+                    continue
+                user_power.append(p.code)
+        session['permissions'] = user_power
+        # 角色存入session
+        roles = []
+        for role in current_user.role.all():
+            roles.append(role.id)
+        session['role'] = [roles]
+
         return success_api(msg="登录成功")
     login_log(request, uid=user.id, is_access=False)
     return fail_api(msg="用户名或密码错误")