学步园

From： http://www.onjava.com/pub/a/onjava/2004/02/18/strutssecurity.html

1. Extending the Struts ActionMapping class

public class StrutsPermissionMapping 
        extends ActionMapping {

    private Integer actionId = null;
    private String label = null;
    private String canBeMadeAvailable = null;
    private String canBeMadeEditable = null;
    private String group = null;
    private String role = null;

    public StrutsPermissionMapping() {
        super();
    }

    public Integer getActionId() {
        return actionId;
    }

    public void setActionId(Integer id) {
        this.actionId = id;
    }    
...
}

2. 修改后的struts-config.xml

<struts-config>
 <form-beans>
   <form-bean name="computeForm"
  	type="com.shiftat.oreilly.web.ComputeForm"/>
...
 </form-beans>
 <action-mappings> 
  <action
   path="/compute"
   type="com.shiftat.oreilly.web.ComputeAction"
   name="computeForm"
   scope="session"
   input="/jsp/compute.jsp"
   className=
    "com.shiftat.struts.StrutsPermissionMapping"
   unknown="false"
   validate="false">
   <set-property property="actionId" 
                 value="160" />
   <set-property property="label" 
                 value="compute"/>
   <set-property property="canBeMadeAvailable" 
                 value="true"/>
   <set-property property="canBeMadeEditable" 
                 value="false"/>
   <set-property property="group" 
                 value="4"/>
   <set-property property="role" 
                 value="4"/>

   <forward name="succes" 
            path="/jsp/result.jsp"
	        redirect="false"/>
  </action>
...
 </action-mappings>
</struts-config>

3.  in the login action

     3.1 Retrieves the user permissions from the datastore.
     3.2 Retrieves the StrutsPermissionMappings from the Struts configuration.
     3.3 Iterates over the user permissions and retrieves the corresponding StrutsPermissionMappings.
     3.4 Stores each of the corresponding StrutsPermissionMappings in a new Map in the context for that user.

Map userActionPermissionMap 
  = retrievePortalUserActionPermissionMap(userId);
Map strutsConfigMap 
  = StrutsConfigurationHelperAction
    .retrieveStrutsActionMapping(this, request);
Map userActionNamePermissionMap = new HashMap();
if (userActionPermissionMap.keySet() != null 
 && userActionPermissionMap.keySet().size() >0) {
  Iterator it 
   = userActionPermissionMap.keySet().iterator();
  while (it.hasNext()){
	Integer actionId = (Integer)it.next();
	Integer permissionId 
	 = (Integer)userActionPermissionMap
	   .get(actionId);
	StrutsPermissionMapping mapping 
	 = (StrutsPermissionMapping)strutsConfigMap
	   .get(actionId);
	String actionPath 
	   = strutsPermissionMapping.getPath();
	userActionNamePermissionMap
	   .put(actionPath, permissionId);
  }
}
context
 .setAttribute("permissionmap",
               userActionNamePermissionMap);

public class StrutsConfigurationHelperAction {
    
 private static SortedMap actionMappingMap = null;
 private static ModuleConfig mConfig = null;
    
 public static SortedMap 
         retrieveStrutsActionMapping(Action action, 
                     HttpServletRequest request) {
   if (actionMappingMap == null){
       actionMappingMap = new TreeMap();
       mConfig = (ModuleConfig)request.
                   getAttribute(Globals.MODULE_KEY);
       if (mConfig == null){
           mConfig = (ModuleConfig)action.
             getServlet().getServletContext().
               getAttribute(Globals.MODULE_KEY);
       }
       if (mConfig != null){
           ActionConfig[] acfg 
               = mConfig.findActionConfigs();
           for (int i=0; i < acfg.length; i++){
              ActionConfig actionConfig = acfg[i];
              if (actionConfig instanceof 
                      StrutsPermissionMapping){
                  StrutsPermissionMapping amp = 
					 (StrutsPermissionMapping)
					       actionConfig;
                   actionMappingMap
				      .put(amp.getActionId(),amp);
               } else {
                   //Regular ActionMapping 
                   //without security attributes
               }
           }
       } else {
          System.err.println
		  		("No Struts configuration !");            
       }
   }
   return actionMappingMap;
 }

}

4. The check that the user has the necessary permission to call a certain action in the application can easily be done in a ServletFilter