SpringMVC集成shiro

- 日理万妓 2021-12-09 14:59 582阅读 0赞

最近公司一个老的后台管理系统需要加权限验证(前端使用easyUI),经过各种踩坑,终于是完成了,话不多说,直接进入主题
数据库结构
用户表(使用的项目本身已经在用的表)

  1. CREATE TABLE `pay_user` (
  2.     `ID` INT(11) NOT NULL AUTO_INCREMENT COMMENT 'ID主键',
  3.     `USER_NAME` VARCHAR(45) NOT NULL COMMENT '登录名称',
  4.     `PASSWORD` VARCHAR(50) NOT NULL COMMENT '密码',
  5.     `STATUS` VARCHAR(1) NOT NULL DEFAULT '0' COMMENT '状态：0：正常,1:禁用;default:0',
  6.     `CREATE_TIME` TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP COMMENT '创建时间',
  7.     `UPDATE_TIME` DATETIME NULL DEFAULT NULL COMMENT '更新时间',
  8.     PRIMARY KEY (`ID`),
  9.     UNIQUE INDEX `ID_UNIQUE` (`ID`) USING BTREE,
  10.     UNIQUE INDEX `USER_NAME_UK` (`USER_NAME`) USING BTREE
  11. )
  12. COMMENT='运营管理用户表'
  13. COLLATE='utf8_general_ci'
  14. ENGINE=InnoDB
  15. AUTO_INCREMENT=48
  16. ;

菜单表

  1. CREATE TABLE `sys_menu` (
  2.     `id` BIGINT(8) NOT NULL AUTO_INCREMENT COMMENT '主键',
  3.     `name` VARCHAR(64) NOT NULL COMMENT '菜单名称',
  4.     `icon` VARCHAR(64) NOT NULL DEFAULT 'icon-nav' COMMENT '图标',
  5.     `url` VARCHAR(255) NULL DEFAULT NULL COMMENT '菜单路径',
  6.     `pid` BIGINT(8) UNSIGNED NOT NULL DEFAULT '0' COMMENT '父级资源id',
  7.     `sort` TINYINT(2) NOT NULL DEFAULT '0' COMMENT '排序',
  8.     `permission_code` VARCHAR(50) NULL DEFAULT NULL COMMENT '权限层级',
  9.     `status` TINYINT(2) NOT NULL DEFAULT '0' COMMENT '状态',
  10.     `menu_flag` TINYINT(1) NULL DEFAULT '0' COMMENT '是否是菜单 0主菜单 1页面 2按钮',
  11.     `description` VARCHAR(255) NULL DEFAULT NULL COMMENT '备注',
  12.     `create_time` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP COMMENT '创建时间',
  13.     `update_time` DATETIME NULL DEFAULT NULL COMMENT '更新时间',
  14.     PRIMARY KEY (`id`)
  15. )
  16. COMMENT='菜单'
  17. COLLATE='utf8_general_ci'
  18. ENGINE=InnoDB
  19. AUTO_INCREMENT=297
  20. ;

角色表(这里当时有个设计缺陷就是应该多加一个code字段)

  1. CREATE TABLE `sys_role` (
  2.     `id` BIGINT(19) NOT NULL AUTO_INCREMENT COMMENT '主键id',
  3.     `name` VARCHAR(64) NOT NULL COMMENT '角色名',
  4.     `sort` TINYINT(2) NOT NULL DEFAULT '0' COMMENT '排序号',
  5.     `description` VARCHAR(255) NULL DEFAULT NULL COMMENT '描述',
  6.     `create_time` DATETIME NULL DEFAULT CURRENT_TIMESTAMP COMMENT '创建时间',
  7.     `update_time` DATETIME NULL DEFAULT NULL COMMENT '更新时间',
  8.     PRIMARY KEY (`id`)
  9. )
  10. COMMENT='角色'
  11. COLLATE='utf8_general_ci'
  12. ENGINE=InnoDB
  13. AUTO_INCREMENT=7
  14. ;

角色-菜单关系表

  1. CREATE TABLE `sys_role_menu` (
  2.     `id` BIGINT(8) NOT NULL AUTO_INCREMENT COMMENT '主键id',
  3.     `role_id` BIGINT(8) NOT NULL COMMENT '角色id',
  4.     `menu_id` BIGINT(8) NOT NULL COMMENT '菜单id',
  5.     PRIMARY KEY (`id`)
  6. )
  7. COMMENT='角色-菜单关系表'
  8. COLLATE='utf8_general_ci'
  9. ENGINE=InnoDB
  10. AUTO_INCREMENT=2763
  11. ;

用户-角色关系表

  1. CREATE TABLE `sys_user_role` (
  2.     `id` BIGINT(8) NOT NULL AUTO_INCREMENT COMMENT '主键id',
  3.     `user_id` BIGINT(8) NOT NULL COMMENT '用户id',
  4.     `role_id` BIGINT(8) NOT NULL COMMENT '角色id',
  5.     PRIMARY KEY (`id`)
  6. )
  7. COMMENT='用户-角色关系表'
  8. COLLATE='utf8_general_ci'
  9. ENGINE=InnoDB
  10. AUTO_INCREMENT=28
  11. ;

1.首先引入依赖

  1. <!-- https://mvnrepository.com/artifact/org.apache.shiro/shiro-web -->
  2.         <dependency>
  3.             <groupId>org.apache.shiro</groupId>
  4.             <artifactId>shiro-web</artifactId>
  5.             <version>1.4.0</version>
  6.         </dependency>
  8.         <!-- https://mvnrepository.com/artifact/org.apache.shiro/shiro-spring -->
  9.         <dependency>
  10.             <groupId>org.apache.shiro</groupId>
  11.             <artifactId>shiro-spring</artifactId>
  12.             <version>1.4.0</version>
  13.         </dependency>
  15.         <!-- https://mvnrepository.com/artifact/org.apache.shiro/shiro-ehcache -->
  16.         <dependency>
  17.             <groupId>org.apache.shiro</groupId>
  18.             <artifactId>shiro-ehcache</artifactId>
  19.             <version>1.4.0</version>
  20.         </dependency>
  22.         <dependency>
  23.             <groupId>org.apache.shiro</groupId>
  24.             <artifactId>shiro-core</artifactId>
  25.             <version>1.4.0</version>
  26.         </dependency>

当然像ehcache如果用不到可以不添加

2.web.xml配置
添加配置

  1. <!--<!–Shiro配置 DelegatingFilterProxy通过代理模式将spring容器中的bean和filter关联起来–>-->
  2.     <filter>
  3.         <filter-name>shiroFilter</filter-name>
  4.         <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
  5.         <!-- 设置true由servlet容器控制filter的生命周期 -->
  6.         <init-param>
  7.             <param-name>targetFilterLifecycle</param-name>
  8.             <param-value>true</param-value>
  9.         </init-param>
  10.     </filter>
  11.     <filter-mapping>
  12.         <filter-name>shiroFilter</filter-name>
  13.         <url-pattern>/*</url-pattern>
  14.     </filter-mapping>

3.spring-shiro.xml

  1. <?xml version="1.0" encoding="UTF-8"?>
  2. <beans xmlns="http://www.springframework.org/schema/beans"
  3.        xmlns:context="http://www.springframework.org/schema/context" xmlns:p="http://www.springframework.org/schema/p"
  4.        xmlns:aop="http://www.springframework.org/schema/aop" xmlns:tx="http://www.springframework.org/schema/tx"
  5.        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  6.        xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.0.xsd
  7.     http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.0.xsd
  8.     http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-4.0.xsd http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-4.0.xsd
  9.     http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-4.0.xsd">
  11.     <!-- shiro -->
  12.     <!-- 1. 将Shiro的生命周期加入Spring
  13.     <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>
  14.     -->
  16.     <!-- 凭证匹配器 -->
  17.     <bean id="credentialsMatcher"
  18.           class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
  19.         <property name="hashAlgorithmName" value="md5"/>
  20.         <property name="hashIterations" value="1"/>
  21.     </bean>
  23.     <!-- 2. 自定义Realm来管理权限 -->
  24.     <bean id="shiroDbRealm" class="com.joiest.jpf.manage.web.shiro.ShiroDbRealm">
  25.         <property name="credentialsMatcher" ref="credentialsMatcher"/>
  26.     </bean>
  28.     <!--<!– 缓存管理器 –>-->
  29.     <!--<bean id="cacheMnager" class="org.apache.shiro.cache.ehcache.EhCacheManager">-->
  30.         <!--<property name="cacheManagerConfigFile" value="classpath:spring/shiro-ehcache.xml"/>-->
  31.     <!--</bean>-->
  33.     <!--<!– 会话管理器 –>-->
  34.     <!--<bean id="sessionManager" class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager">-->
  35.         <!--<!– session的失效时长，单位毫秒 –>-->
  36.         <!--<property name="globalSessionTimeout" value="1800000"/>-->
  37.         <!--<!– 删除失效的session –>-->
  38.         <!--<property name="deleteInvalidSessions" value="true"/>-->
  39.     <!--</bean>-->
  41.     <!-- 3. 将自定义Realm赋值给securityManager -->
  42.     <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
  43.         <property name="realm" ref="shiroDbRealm"/>
  44.         <!--<property name="sessionManager" ref="sessionManager" />-->
  45.         <!--<property name="cacheManager" ref="cacheMnager" />-->
  46.     </bean>
  48.     <!-- 4. 配置SecurityUtils将securityManager-->
  49.     <bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
  50.         <property name="staticMethod" value="org.apache.shiro.SecurityUtils.setSecurityManager"/>
  51.         <property name="arguments" ref="securityManager"/>
  52.     </bean>
  54.     <!-- 5. 配置shiroFilter-->
  55.     <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
  56.         <!-- Shiro的核心安全接口，这个属性是必须的 -->
  57.         <property name="securityManager" ref="securityManager"/>
  58.         <!-- 要求登录时的链接(登录页面地址)，非必须的属性，默认会自动寻找Web工程根目录下的"/login.jsp"页面 -->
  59.         <property name="loginUrl" value="/"/>
  60.         <!-- 登录成功后要跳转的连接(本例中此属性用不到，因为登录成功后的处理逻辑在页面处理的) -->
  61.         <property name="successUrl" value="/backIndex.jsp" ></property>
  62.         <!-- 用户访问未对其授权的资源时，所显示的连接 -->
  63.         <property name="unauthorizedUrl" value="/refuse.jsp"></property>
  64.         <!-- 过虑器链定义，从上向下顺序执行，一般将/**放在最下边 -->
  65.         <property name="filterChainDefinitionMap"  ref="filterChainDefinitionMap">
  66.         </property>
  68.        <property name="filterChainDefinitions">
  69.             <value>
  70.                 <!-- anon不需要认证-->
  71.                 <!--/login = anon-->
  72.                 /resources/** = anon
  73.                 /user/login = anon
  74.                 /user/logout = anon
  76.                  <!--这里可以控制地址栏输入url也进行拦截,但是这样配置太繁琐,下篇文章会扩展-->
  77.                 /user/index = perms["userManage:all"]
  79.                 <!--/user/index = anon-->
  80.                 <!--所有的请求(除去配置的静态资源请求或请求地址为anon的请求)都要通过登录验证,如果未登录则跳到/login -->
  81.                 /** = authc
  83.             </value>
  84.         </property>
  85.     </bean>
  86. </beans>

4.创建自定义Realm

  1. package com.joiest.jpf.manage.web.shiro;
  3. import com.joiest.jpf.common.po.SysMenu;
  4. import com.joiest.jpf.common.po.SysRoleMenu;
  5. import com.joiest.jpf.common.po.SysUserRole;
  6. import com.joiest.jpf.common.util.Md5Encrypt;
  7. import com.joiest.jpf.common.util.SHA1;
  8. import com.joiest.jpf.entity.UserInfo;
  9. import com.joiest.jpf.facade.SysMenuFacade;
  10. import com.joiest.jpf.facade.SysRoleMenuFacade;
  11. import com.joiest.jpf.facade.SysUserRoleFacade;
  12. import com.joiest.jpf.facade.UserServiceFacade;
  13. import org.apache.commons.lang3.StringUtils;
  14. import org.apache.shiro.authc.*;
  15. import org.apache.shiro.authz.AuthorizationInfo;
  16. import org.apache.shiro.authz.SimpleAuthorizationInfo;
  17. import org.apache.shiro.realm.AuthorizingRealm;
  18. import org.apache.shiro.subject.PrincipalCollection;
  19. import org.apache.shiro.util.ByteSource;
  20. import org.springframework.beans.factory.annotation.Autowired;
  22. import java.util.ArrayList;
  23. import java.util.HashSet;
  24. import java.util.List;
  26. public class ShiroDbRealm extends AuthorizingRealm {
  27.     @Autowired
  28.     private UserServiceFacade userServiceFacade;
  29.     @Autowired
  30.     private SysUserRoleFacade sysUserRoleFacade;
  31.     @Autowired
  32.     private SysRoleMenuFacade sysRoleMenuFacade;
  33.     @Autowired
  34.     private SysMenuFacade sysMenuFacade;
  36.     //认证
  37.     @Override
  38.     protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
  39.         System.out.println("=================doGetAuthenticationInfo[登录认证]=====================");
  40.         UsernamePasswordToken token = (UsernamePasswordToken) authenticationToken;
  41.         System.out.println("当前认证用户：" + token.getUsername());
  42.         UserInfo user = userServiceFacade.getByLoginName(token.getUsername());
  43.         if (user != null) {
  44.             ShiroUser shiroUser = new ShiroUser(user.getUserName());
  45.             shiroUser.setId(user.getId()+"");
  46.             shiroUser.setName(user.getUserName());
  47.             //以创建时间作为盐(加密用的)
  48. //            String salt = String.valueOf(user.getCreateTime().getTime());
  49.             return new SimpleAuthenticationInfo(shiroUser, Md5Encrypt.md5(user.getPassword()), getName());
  50.         }
  51.         return null;
  52.     }
  54.     //授权
  55.     @Override
  56.     protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
  57.         System.out.println("=================doGetAuthorizationInfo[授权认证]=====================");
  58.         ShiroUser shiroUser = (ShiroUser) principalCollection.getPrimaryPrincipal();
  60.         SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
  61.         List<String> permissions = new ArrayList<>();
  62.         //由于炒鸡管理员权限太多,加载每次点击菜单加载数据很慢,所以这里用了缓存,只第一次加载
  63.         if (shiroUser.getPermissions()==null || shiroUser.getPermissions().size() == 0){
  64.             //获取所有权限
  65.             List<SysUserRole> sysUserRoles =sysUserRoleFacade.selectRolesByUserId(shiroUser.getId());
  66.             for (SysUserRole sysUserRole : sysUserRoles) {
  67.                 List<SysRoleMenu> sysRoleMenus = sysRoleMenuFacade.getRoleMenuByRoleId(sysUserRole.getRoleId());
  68.                 if (sysRoleMenus.size()>0){
  69.                     for (SysRoleMenu sysRoleMenu : sysRoleMenus) {
  70.                         SysMenu menu = sysMenuFacade.getMenuById(sysRoleMenu.getMenuId());
  71.                         if(menu!=null&& StringUtils.isNotBlank(menu.getPermissionCode())){
  72.                             permissions.add(menu.getPermissionCode());
  73.                         }
  74.                     }
  75.                 }
  77.             }
  79.             shiroUser.setPermissions(new HashSet<>(permissions));
  80.             info.addStringPermissions(permissions);
  82.         }else{
  83.             //info里存的就是所有的权限
  84.             info.addStringPermissions(shiroUser.getPermissions());
  85.         }
  88.         return info;
  89.     }
  91. }

5.User类 shiroUser

  1. package com.joiest.jpf.manage.web.shiro;
  3. import java.io.Serializable;
  4. import java.util.Set;
  6. public class ShiroUser implements Serializable {
  8.     private String id;
  9.     private final String loginName;
  10.     private String name;
  11.     private Set<String> permissions;
  13.     public String getId() {
  14.         return id;
  15.     }
  17.     public void setId(String id) {
  18.         this.id = id;
  19.     }
  21.     public ShiroUser(String loginName) {
  22.         this.loginName = loginName;
  23.     }
  25.     public String getLoginName() {
  26.         return loginName;
  27.     }
  29.     public String getName() {
  30.         return name;
  31.     }
  33.     public void setName(String name) {
  34.         this.name = name;
  35.     }
  37.     public Set<String> getPermissions() {
  38.         return permissions;
  39.     }
  41.     public void setPermissions(Set<String> permissions) {
  42.         this.permissions = permissions;
  43.     }
  44. }

6.Tree

  1. package com.joiest.jpf.entity;
  3. import java.io.Serializable;
  4. import java.util.Date;
  5. import java.util.List;
  7. public class Tree implements Serializable {
  8.     private Integer id;
  9.     private String text;
  10.     private int seq;
  11.     private boolean checked = false;// true,false
  12.     private boolean onlyLeafCheck = false;
  13.     private String state = "open";
  14.     private String code;
  15.     private List<Tree> children;
  16.     private String iconCls;
  17.     private Integer pid;
  18.     private Integer isLeaf;
  19.     private String url;
  20.     private String createTime;
  21.     private String updateTime;
  23.         public String getState() {
  24.         return state;
  25.     }
  27.     public void setState(String state) {
  28.         this.state = state;
  29.     }
  31.     public boolean getOnlyLeafCheck() {
  32.         return onlyLeafCheck;
  33.     }
  35.     public void setOnlyLeafCheck(boolean onlyLeafCheck) {
  36.         this.onlyLeafCheck = onlyLeafCheck;
  37.     }
  39.     public Integer getId() {
  40.         return id;
  41.     }
  43.     public void setId(Integer id) {
  44.         this.id = id;
  45.     }
  47.     public String getText() {
  48.         return text;
  49.     }
  51.     public void setText(String text) {
  52.         this.text = text;
  53.     }
  55.     public boolean getChecked() {
  56.         return checked;
  57.     }
  59.     public void setChecked(boolean checked) {
  60.         this.checked = checked;
  61.     }
  63.     public String getCode() {
  64.         return code;
  65.     }
  67.     public void setCode(String code) {
  68.         this.code = code;
  69.     }
  71.     public List<Tree> getChildren() {
  72.         return children;
  73.     }
  75.     public void setChildren(List<Tree> children) {
  76.         this.children = children;
  77.     }
  79.     public String getIconCls() {
  80.         return iconCls;
  81.     }
  83.     public void setIconCls(String iconCls) {
  84.         this.iconCls = iconCls;
  85.     }
  87.     public Integer getPid() {
  88.         return pid;
  89.     }
  91.     public void setPid(Integer pid) {
  92.         this.pid = pid;
  93.     }
  95.     public Integer getIsLeaf() {
  96.         return isLeaf;
  97.     }
  99.     public void setIsLeaf(Integer isLeaf) {
  100.         this.isLeaf = isLeaf;
  101.     }
  103.     public String getUrl() {
  104.         return url;
  105.     }
  107.     public void setUrl(String url) {
  108.         this.url = url;
  109.     }
  111.     public int getSeq() {
  112.         return seq;
  113.     }
  115.     public void setSeq(int seq) {
  116.         this.seq = seq;
  117.     }
  119.     public String getCreateTime() {
  120.         return createTime;
  121.     }
  123.     public void setCreateTime(String createTime) {
  124.         this.createTime = createTime;
  125.     }
  127.     public String getUpdateTime() {
  128.         return updateTime;
  129.     }
  131.     public void setUpdateTime(String updateTime) {
  132.         this.updateTime = updateTime;
  133.     }
  134. }

7.登录 调用shiro的login()方法

  1. @RequestMapping(value = "/user/login", method = RequestMethod.POST)
  2.     public ModelAndView login(HttpServletRequest request,HttpSession httpSession, Model model) {
  3.         String loginName = request.getParameter("user");
  4.         String password = request.getParameter("pwd");
  5.         Subject user = SecurityUtils.getSubject();
  6.         UsernamePasswordToken token = new UsernamePasswordToken(loginName, SHA1.getInstance().getMySHA1Code(password));
  8.         if (StringUtils.isBlank(loginName)||StringUtils.isBlank(password)) {
  9.             model.addAttribute("error", "用户名或密码错误");
  10.             return new ModelAndView("login");
  11.         }
  13.         UserInfo info = userServiceFacade.getByLoginName(loginName);
  14.         if (info == null){
  15.             model.addAttribute("error", "用户不存在或者密码错误！");
  16.             return new ModelAndView("login");
  17.         }
  19.         if (!EnumConstants.UserStatus.normal.value().equals(info.getStatus())){
  20.             model.addAttribute("error", "用户已禁用！");
  21.             return new ModelAndView("login");
  22.         }
  24.         List<SysUserRole> userRoles = sysUserRoleFacade.selectRolesByUserId(info.getId() + "");
  25.         if (userRoles.size() == 0){
  26.             model.addAttribute("error", "用户未分配角色,请联系管理员！");
  27.             return new ModelAndView("login");
  28.         }
  30.         try {
  31.             //shiro的login()方法
  32.             user.login(token);
  33.         } catch (UnknownAccountException  e) {
  34.             model.addAttribute("error", "用户不存在或者密码错误！");
  35.             return new ModelAndView("login");
  36.         } catch (IncorrectCredentialsException ex) {
  37.             model.addAttribute("error","用户不存在或者密码错误！") ;
  38.             return new ModelAndView("login");
  39.         } catch (AuthenticationException ex) {
  40.             model.addAttribute("error","用户名或密码错误");
  41.             return new ModelAndView("login");
  42.         } catch (Exception ex) {
  43.             model.addAttribute("error","内部错误，请重试！");
  44.             return new ModelAndView("login");
  45.         }
  47.         PayUser userInfo = userServiceFacade.loginVerify(loginName, password);
  49.         //登录信息存进session
  50.         httpSession.setAttribute(ManageConstants.USERINFO_SESSION,userInfo);
  51.         httpSession.setMaxInactiveInterval(30*60);//以秒为单位，即在没有活动30分钟后，session将失效
  52.         return new ModelAndView("/backIndex");
  53.     }

8.跳转到首页后发送ajax请求(/menu)查询当前用户下的所有菜单

controller

  1. @RequestMapping("/menu")
  2.     @ResponseBody
  3.     public Object getMenu(){
  4.         UserInfo sessionUser = SessionUtil.getSessionUser();
  5.         Integer id = sessionUser.getId();
  7.         List<Tree> treeList = sysMenuFacade.treeList(id);
  8.         JSONArray jsonArray = JSONArray.parseArray(JSON.toJSONString(treeList));
  10.         return jsonArray;
  11.     }

serviceImpl

  1. @Override
  2.     public List<Tree> treeList(Integer id) {
  3.         List<SysMenu> menuList = sysMenuMapper.selectMenuListByUserId(id);
  4.         List<Tree> treeList = prepareTree(menuList);
  5.         //排序调整菜单顺序
  6.         Collections.sort(treeList, new Comparator<Tree>() {
  7.             @Override
  8.             public int compare(Tree t1, Tree t2) {
  9.                 return t1.getSeq() - t2.getSeq();
  10.             }
  11.         });
  13.         return treeList;
  14.     }
  16. private List<Tree> prepareTree(List<SysMenu> menuList) {
  17.         List<Tree> allTreeList = menuListToTreeList(menuList);
  18.         List<Tree> topList = new ArrayList<>();
  19.         for (Tree tree : allTreeList) {
  20.             // 遍历所有节点，将父菜单id与传过来的id比较
  21.             if (tree.getPid() == 0) {
  22.                 tree.setChildren(prepareTreeChiled(tree.getId(), allTreeList));
  23.                 topList.add(tree);
  24.                 Collections.sort(topList, new Comparator<Tree>() {
  25.                     @Override
  26.                     public int compare(Tree o1, Tree o2) {
  27.                         return o1.getSeq() - o2.getSeq();
  28.                     }
  29.                 });
  30.             }
  31.         }
  32.         return topList;
  33.     }
  35.     private List<Tree> prepareTreeChiled(Integer id, List<Tree> allTreeList) {
  36.         // 子菜单
  37.         List<Tree> childList = new ArrayList<>();
  38.         for (Tree tree : allTreeList) {
  39.             // 遍历所有节点，将父菜单id与传过来的id比较
  40.              //这里有个坑 因为常量池里127 == 127是成立的  129 == 129不成立 所以比较用equals
  41.             if (!"0".equals(tree.getPid()+"") && (id+"").equals(tree.getPid()+"")) {
  42.                 childList.add(tree);
  43.                 Collections.sort(childList, new Comparator<Tree>() {
  44.                     @Override
  45.                     public int compare(Tree o1, Tree o2) {
  46.                         return o1.getSeq() - o2.getSeq();
  47.                     }
  48.                 });
  49.             }
  50.         }
  51.         // 把子菜单的子菜单再循环一遍
  52.         for (Tree tree : childList) {
  53.                 tree.setChildren(prepareTreeChiled(tree.getId(), allTreeList));
  54.         }
  55.         // 递归退出条件
  56.         if (childList.size() == 0) {
  57.             return null;
  58.         }
  59.         return childList;
  60.     }
  62.     private List<Tree> menuListToTreeList(List<SysMenu> menuList) {
  63.         List<Tree> treeList = new ArrayList<>();
  64.         if (menuList != null && menuList.size() > 0) {
  65.             for (SysMenu menu : menuList) {
  66.                 treeList.add(menuToTree(menu));
  67.             }
  68.         }
  69.         return treeList;
  70.     }
  72.     private Tree menuToTree(SysMenu menu) {
  73.         Tree tree = new Tree();
  74.         tree.setId(Integer.valueOf(menu.getId()));
  75.         tree.setText(menu.getName());
  76.         tree.setIconCls(menu.getIcon());
  77.         tree.setIsLeaf(Integer.valueOf(menu.getMenuFlag()));
  78.         tree.setPid(Integer.valueOf(menu.getPid()));
  79.         tree.setSeq(menu.getSort());
  80.         tree.setUrl(menu.getUrl());
  81.         tree.setCode(menu.getPermissionCode());
  82.         tree.setChecked(menu.getChecked());
  85.         SimpleDateFormat formatter = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
  86.         String createTime = formatter.format(menu.getCreateTime());
  87.         if (menu.getUpdateTime() != null){
  88.             String updateTime = formatter.format(menu.getUpdateTime());
  89.             tree.setUpdateTime(updateTime);
  90.         }
  92.         tree.setCreateTime(createTime);
  94.         return tree;
  95.     }

selectMenuListByUserId sql

  1. <select id="selectMenuListByUserId" resultMap="BaseResultMap">
  2.     select distinct m.id,m.name,m.icon,m.url,m.pid,m.sort,m.permission_code,m.`status`,m.menu_flag,
  3.     m.description,m.create_time,m.update_time
  4.     from sys_menu m
  5.     left join sys_role_menu rm
  6.     on m.id = rm.menu_id
  7.     left join sys_role r
  8.     on r.id = rm.role_id
  9.     left join sys_user_role ur
  10.     on ur.role_id = r.id
  11.     left join pay_user u
  12.     on u.id = ur.user_id
  13.     where u.id = #{id}
  14.     and m.menu_flag != 2
  15.   </select>

8.页面配置
//menu:add 是你表中自定义的权限code


//这里是你要控制的按钮代码

这样只要你的用户下有menu:add这个权限,就可以看到被shiro标签包含的按钮,反之则看不到

9.至于上面配置文件中提到的:
/user/index = perms[“userManage:all”]
这个是用来防止有人直接在地址栏输入地址的,你可以尝试一下,一个用户没有某个页面的权限,但是直接地址栏输入地址还是可以访问的,只不过没有权限的按钮不会显示出来,但这样明显是不可行的,所以每多一个页面都需要在配置文件配置这个参数,这样很繁琐,下一篇文章会介绍一种自定义filterChainDefinitionMap的方式

发表评论

表情：
评论列表 （有 0 条评论，582人围观）

还没有评论，来说两句吧...

相关阅读

    相关 SpringMVC集成shiro

    最近公司一个老的后台管理系统需要加权限验证(前端使用easyUI),经过各种踩坑,终于是完成了,话不多说,直接进入主题 数据库结构 用户表(使用的项目本身已经在用的表)

    - 日理万妓- 日理万妓/ 0 赞/ 583 阅读