protected function _initialize()
{
C(array("USER_AUTH_ON" => true, "USER_AUTH_TYPE" => 1, "REQUIRE_AUTH_MODULE" => "", "NOT_AUTH_MODULE" => "Public,Login", "USER_AUTH_GATEWAY" => U("/Admins/Login")));
if (false == RBAC::AccessDecision(MODULE_NAME)) {
//检查是否登录
if (false === RBAC::checkLogin()) {
//跳转到登录界面
redirect(C('USER_AUTH_GATEWAY'));
}
//没有操作权限
$this->error('您没有操作此项的权限！');
}
parent::_initialize();
//验证登录
$this->competence();
}
public static function AccessDecision($appName = MODULE_NAME)
{
//检查是否需要认证
if (RBAC::checkAccess()) {
//存在认证识别号，则进行进一步的访问决策
$accessGuid = md5($appName . CONTROLLER_NAME . ACTION_NAME);
//判断是否超级管理员，是无需进行权限认证
if (Admin::getInstance()->isAdministrator() !== true) {
//认证类型 1 登录认证 2 实时认证
if (C('USER_AUTH_TYPE') == 2) {
//加强验证和即时验证模式 更加安全 后台权限修改可以即时生效
//通过数据库进行访问检查
$accessList = RBAC::getAccessList(Admin::getInstance()->id);
} else {
// 如果是管理员或者当前操作已经认证过，无需再次认证
if (session($accessGuid)) {
return true;
}
//登录验证模式，登录后保存的可访问权限列表
$accessList = session("_ACCESS_LIST");
}
//判断是否为组件化模式，如果是，验证其全模块名
$controller = defined('P_CONTROLLER_NAME') ? P_CONTROLLER_NAME : CONTROLLER_NAME;
if (!isset($accessList[strtoupper($appName)][strtoupper($controller)][strtoupper(ACTION_NAME)])) {
//验证登录
if (self::checkLogin() == true) {
//做例外处理，只要有管理员帐号，都有该项权限
if ($appName == "Admins" && in_array(CONTROLLER_NAME, array("Index", "Main")) && in_array(ACTION_NAME, array("index"))) {
session($accessGuid, true);
return true;
}
//如果是public_开头的验证通过。
if (substr(ACTION_NAME, 0, 7) == 'public_') {
session($accessGuid, true);
return true;
}
//内容模块特殊处理
if ($appName == 'Home' && CONTROLLER_NAME == 'Home') {
session($accessGuid, true);
return true;
}
}
session($accessGuid, false);
return false;
} else {
session($accessGuid, true);
}
} else {
//超级管理员直接验证通过，且检查是否登录
if (self::checkLogin()) {
return true;
}
return false;
}
}
return true;
}
<?php
if (!defined('SHUIPF_VERSION')) {
exit;
}
?>
<Admintemplate file="Common/Head"/>
<body class="J_scroll_fixed">
<div class="wrap J_check_wrap">
<div class="nav">
<ul class="cc">
<li><a href="{:U('Style/index')}">模板管理</a></li>
<?php
if (\Libs\System\RBAC::authenticate('add')) {
?>
<li><a href="{:U("Template/Style/add",array("dir"=>urlencode(str_replace('/','-',$dir)) ))}">在此目录下添加模板</a></li>
<?php
}
?>
</ul>
</div>
<div class="h_a">模板编辑</div>
<form name="myform" id="myform" action="{:U("Template/Style/edit")}" method="post">
<input type="hidden" name="dir" value="{$dir}"/>
<input type="hidden" name="file" value="{$file}"/>
<div class="table_full">
<table cellpadding="0" cellspacing="0" class="table_form" width="100%">
<tbody>
<tr>
<th width="120">文件名称</th>
<td><input type="text" class="input" validate="required:true, minlength:2, maxlength:30" value="{$file}" readonly></td>
<font color="#FF0000">无限制</font>
<else />
多模型
</if>
</td>
<td align="center">
<?php
$op = array();
if (\Libs\System\RBAC::authenticate('item')) {
$op[] = '<a href="' . U('Position/item', array('posid' => $vo['posid'])) . '">信息管理</a>';
}
if (\Libs\System\RBAC::authenticate('rebuilding')) {
$op[] = '<a href="' . U('Position/rebuilding', array('posid' => $vo['posid'])) . '">数据重建</a>';
}
if (\Libs\System\RBAC::authenticate('edit')) {
$op[] = '<a href="' . U('Position/edit', array('posid' => $vo['posid'])) . '">修改</a>';
}
if (\Libs\System\RBAC::authenticate('delete')) {
$op[] = '<a class="J_ajax_del" href="' . U('Position/delete', array('posid' => $vo['posid'])) . '">删除</a>';
}
echo implode(" | ", $op);
?>
</tr>
</volist>
</tbody>
</table>
</div>
</div>
<script src="{$config_siteurl}statics/js/common.js?v"></script>
</body>
</html>
public function public_delthumbs()
{
//检查是否有删除附件权限
if (\Libs\System\RBAC::authenticate('Attachment/Atadmin/delete') == false) {
exit('您没有附件删除权限！');
}
$filepath = urldecode(I('get.filepath', '', ''));
$reslut = @unlink($filepath);
if ($reslut) {
exit('1');
}
exit('附件删除失败！');
}
</table>
</div>
<script type="text/javascript">
//全局变量
var GV = {
DIMAUB: "__ROOT__/",
JS_ROOT: "__JS__/"
};
</script>
<script src="__JS__/wind.js"></script>
<script src="__JS__/jquery.min.js"></script>
<script src="__JS__/common.js"></script>
<literal>
<script>
<?php
if (\Libs\System\RBAC::authenticate('Admins/Index/cache')) {
?>
$("#deletecache").on('click',function(e){
e.preventDefault();
e.stopPropagation();
iframeJudge({
elem: $(this),
href: "<?php
echo U('Index/cache');
?>
",
id: "deletecache"
});
});
<?php
}
</tr>
</thead>
<tbody>
<volist name="data" id="vo">
<tr>
<td align="left"><input type="checkbox" name="items[]" value="{$vo.id}-{$vo.modelid}" class="J_check" data-yid="J_check_y" data-xid="J_check_x"></td>
<td align="left"><input name='listorders[{$vo.catid}-{$vo.id}]' type='text' size='3' value='{$vo.listorder}' class="input"></td>
<td align="left">{$vo.id}</td>
<td align="left">{$vo.data.title} </td>
<td align="center">{:getCategory($vo['catid'],'catname')}</td>
<td align="center">{$vo.data.inputtime|date="Y-m-d H:i:s",###}</td>
<td align="center">
<a href="{$vo.data.url}" target="_blank">原文</a> |
<a onClick="javascript:openwinx('{:U("Content/edit",array("catid"=>$vo['catid'],"id"=>$vo['id'] ))}','')" href="javascript:;">原文编辑</a>
<?php
if (\Libs\System\RBAC::authenticate('item_manage')) {
?>
| <a href="javascript:item_manage({$vo.id},{$vo.posid}, {$vo.modelid},'{$vo.data.title}')">信息管理</a>
<?php
}
?>
</td>
</tr>
</volist>
</tbody>
</table>
<div class="p10">
<div class="pages"> {$Page} </div>
</div>
</div>
<div class="">
if (\Libs\System\RBAC::authenticate('createhtml')) {
$op[] = '<a href="' . U("Custompage/createhtml", array('tempid' => $vo['tempid'])) . '">更新</a>';
}
echo implode(' | ', $op);
?>
</td>
</tr>
</volist>
</tbody>
</table>
<div class="p10">
<div class="pages"> {$Page} </div>
</div>
</div>
<div class="btn_wrap">
<div class="btn_wrap_pd">
<label class="mr20"><input type="checkbox" class="J_check_all" data-direction="y" data-checklist="J_check_y">全选</label>
<?php
if (\Libs\System\RBAC::authenticate('createhtml')) {
?>
<button class="btn btn_submit mr10 J_ajax_submit_btn" type="submit">生成自定义页面</button>
<?php
}
?>
</div>
</div>
</form>
</div>
<script src="{$config_siteurl}statics/js/common.js"></script>
</body>
</html>
if (\Libs\System\RBAC::authenticate('generate')) {
$op[] = '<a href="' . U("Customlist/generate", array('id' => $vo['id'])) . '">更新</a>';
}
echo implode(' | ', $op);
?>
</td>
</tr>
</volist>
</tbody>
</table>
<div class="p10">
<div class="pages"> {$Page} </div>
</div>
</div>
<div class="btn_wrap">
<div class="btn_wrap_pd">
<label class="mr20"><input type="checkbox" class="J_check_all" data-direction="y" data-checklist="J_check_y">全选</label>
<?php
if (\Libs\System\RBAC::authenticate('generate')) {
?>
<button class="btn btn_submit mr10 J_ajax_submit_btn" type="submit">生成列表</button>
<?php
}
?>
</div>
</div>
</form>
</div>
<script src="{$config_siteurl}statics/js/common.js"></script>
</body>
</html>
public function public_step_3()
{
if (\Libs\System\RBAC::authenticate('install') !== true) {
$this->errors('您没有该项权限！');
}
$module = I('get.module');
S('Cloud', NULL);
if ($this->Module->install($module)) {
ShuipFCMS()->Dir->delDir(APP_PATH . "{$module}/Install/");
$this->success('模块安装成功！');
} else {
$error = $this->Module->error;
//删除目录
ShuipFCMS()->Dir->delDir(APP_PATH . $module);
$this->error($error ? $error : '模块安装失败！');
}
}
/**
* 注册用户登录状态
* @param array $userInfo 用户信息
*/
private function registerLogin(array $userInfo)
{
//写入session
session(self::userUidKey, \Libs\Util\Encrypt::authcode((int) $userInfo['id'], ''));
//更新状态
D('Admin/User')->loginStatus((int) $userInfo['id']);
//注册权限
\Libs\System\RBAC::saveAccessList((int) $userInfo['id']);
}
$operate[] = '<a href="' . U("edit", array("modelid" => $vo['modelid'])) . '">修改</a>';
}
if (\Libs\System\RBAC::authenticate('Field/index')) {
$operate[] = '<a href="' . U("Field/index", array("modelid" => $vo['modelid'])) . '">字段管理</a>';
}
if (\Libs\System\RBAC::authenticate('disabled')) {
if ($vo['disabled'] == 0) {
$operate[] = '<a href="' . U("disabled", array("modelid" => $vo['modelid'], "disabled" => 0)) . '">禁用</a>';
} else {
$operate[] = '<a href="' . U("disabled", array("modelid" => $vo['modelid'], "disabled" => 1)) . '"><font color="#FF0000">启用</font></a>';
}
}
if (\Libs\System\RBAC::authenticate('delete')) {
$operate[] = '<a class="J_ajax_del" href="' . U("delete", array("modelid" => $vo['modelid'])) . '">删除</a>';
}
if (\Libs\System\RBAC::authenticate('export')) {
$operate[] = '<a href="' . U("export", array("modelid" => $vo['modelid'])) . '">导出模型</a>';
}
echo implode(' | ', $operate);
?>
</td>
</tr>
</volist>
</tbody>
</table>
</div>
</div>
<script src="{$config_siteurl}statics/js/common.js?v"></script>
<script type="text/javascript">
</script>
public function public_upgrade_3()
{
if (\Libs\System\RBAC::authenticate('upgrade') !== true) {
$this->errors('您没有该项权限！');
}
$name = I('get.name');
S('Cloud', NULL);
if (D('Addons/Addons')->upgradeAddon($name)) {
ShuipFCMS()->Dir->delDir(PROJECT_PATH . "Addon/{$name}/Upgrade/");
$this->success('插件升级成功！');
} else {
$error = $this->Module->error;
$this->error($error ? $error : '插件升级失败！');
}
}
