关于越权访问访问的问题,请指教

[sheen7758]

1: 以超管 admin 省份登陆某系统;

2: 找到一个只有超管才有的功能的链接,比如说:"http://localhost/mywebappname/userManage/userList.do" , 显示出所有的user,并复制此链接.

3. 以普通用户登陆进系统,在地址栏输入: userManage/userList.do ,就造成了,普通用户的越权访问.


请问:有什么方法可以解决这个大问题吗?

[KK3K2005]

userList.do 就不能验证访问者身份?
不能验证的话 还要登陆干什么?

[sheen7758]

[Quote=引用 2 楼 KK3K2005 的回复:]
userList.do 就不能验证访问者身份?
不能验证的话 还要登陆干什么?
[/Quote]

如果功能很多的话,每次进入一个action里都得重复调用 同一个验证方法.

有点啰嗦....

不知道有没有什么别的好的方法.

[my145794]

这个简单
登陆时将用户名存入session
session.setAttribute("username",username);

在相关页面判断
if((String)session.getAttribute("username")!=admin){
(response.sendRedirect("XXX.jsp")};

[chch87]

用过滤器，再配合session就像楼上说的。

[chch87]

这样就可以免除重复代码了
网上例子不少，随便搜搜就可以了

[sheen7758]

谢谢 两位楼上.

终于搞定了.

贴出来分享:

/*==============================web.xml============================================*/

	<filter>
		<filter-name>unimpowerAccess</filter-name>
		<filter-class>
			com.family.renguanghui.filter.UnimpowerAccessFilter
		</filter-class>
		<init-param>
			<param-name>freePages</param-name>
			<param-value>/bdmobile/;/login.jsp;/managerLoginAction.do;/unimpower.jsp;/sysError.jsp</param-value>
		</init-param>
		<init-param>
			<param-name>toPage</param-name>
			<param-value>/unimpower.jsp</param-value>
		</init-param>
	</filter>
	<filter-mapping>
		<filter-name>unimpowerAccess</filter-name>
		<url-pattern>*.do</url-pattern>
	</filter-mapping>

	<filter-mapping>
		<filter-name>unimpowerAccess</filter-name>
		<url-pattern>*.jsp</url-pattern>
	</filter-mapping>

/*==============================UnimpowerAccessFilter.java============================================*/

package com.family.renguanghui.filter;

import java.io.IOException;
import java.util.StringTokenizer;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import com.hebslsy.bdmobile.manager.ManagerPopedomMenuDao;

@SuppressWarnings("serial")
public class UnimpowerAccessFilter extends HttpServlet implements Filter {
	private FilterConfig filterConfig;

	private String[] freePagesAyyay;

	private String toPage = null;

	public FilterConfig getFilterConfig() {
		return this.filterConfig;
	}

	public void setFilterConfig(FilterConfig filterConfig) {
		this.filterConfig = filterConfig;
	}

	// 父类的方法
	public void destroy() {

	}

	/**
	 * 初始化filter（这里重写父类的方法）
	 * 
	 * @param filterConfig
	 *            FilterConfig filter配置对象
	 * @throws ServletException
	 */
	public void init(FilterConfig filterConfig) throws ServletException {
		int i = 0;
		String freePages = null;
		StringTokenizer strTokenizer = null;

		setFilterConfig(filterConfig);

		// 以下从配置文件获取配置信息
		this.toPage = filterConfig.getInitParameter("toPage");

		freePages = filterConfig.getInitParameter("freePages");

		strTokenizer = new StringTokenizer(freePages, ";");
		this.freePagesAyyay = new String[strTokenizer.countTokens()];

		while (strTokenizer.hasMoreTokens()) {
			freePagesAyyay[i++] = strTokenizer.nextToken();
		}
	}

	/**
	 * 过滤动作
	 * 
	 * @param request
	 *            ServletRequest 请求对象
	 * @param response
	 *            ServletResponse 响应对象
	 * @param filterChain
	 *            FilterChain 过滤器链对象
	 */
	public void doFilter(ServletRequest request, ServletResponse response,
			FilterChain filterChain) {
		String requestURI = null;
		HttpServletRequest httpRequest = (HttpServletRequest) request;
		HttpServletResponse httpResponse = (HttpServletResponse) response;
		requestURI = httpRequest.getRequestURI();

		boolean isHaveThePopedom = false;

		if (!requestURI.endsWith("/")) {
			int charIndex = requestURI.lastIndexOf('/');
			requestURI = requestURI.substring(charIndex);
		}

		if (!isFreePage(requestURI)) { // 如果是保护页面

			ManagerPopedomMenuDao mpm = new ManagerPopedomMenuDao(httpRequest
					.getSession());

			isHaveThePopedom = mpm.txnIsHaveThePopedom(httpRequest);

			if (!isHaveThePopedom) {
				String toPageURL = null;
				try {
					toPageURL = httpRequest.getContextPath() + toPage;
					httpResponse.encodeRedirectURL(toPageURL);
					httpResponse.sendRedirect(toPageURL); // 转发响应
				} catch (IOException ex) {
					ex.printStackTrace();
				}
			}

		}

		if (!httpResponse.isCommitted()) { // 如果响应未提交,交给过滤器链
			try {
				filterChain.doFilter(request, response);
			} catch (ServletException sx) {
				filterConfig.getServletContext().log(sx.getMessage());
			} catch (IOException iox) {
				filterConfig.getServletContext().log(iox.getMessage());
			}
		}

	}

	/**
	 * 判断一个请求URI是否是不过滤的页面
	 * 
	 * @param requestURI
	 *            String 请求URI
	 * @return boolean 返回true为不过滤页面
	 */
	private boolean isFreePage(String requestURI) {
		boolean isFree = false;

		for (int i = 0; i < freePagesAyyay.length; i++) {
			if (requestURI.endsWith(freePagesAyyay[i])) {
				return true;
			}
		}
		return isFree;
	}

}

[sheen7758]

ps:

        if (!isFreePage(requestURI)) { // 如果是保护页面

            /* 我自己的验证方法 begin*/
            ManagerPopedomMenuDao mpm = new ManagerPopedomMenuDao(httpRequest
                    .getSession());

            isHaveThePopedom = mpm.txnIsHaveThePopedom(httpRequest);
          /* 我自己的验证方法 end*/

            if (!isHaveThePopedom) {
                String toPageURL = null;
                try {
                    toPageURL = httpRequest.getContextPath() + toPage;
                    httpResponse.encodeRedirectURL(toPageURL);
                    httpResponse.sendRedirect(toPageURL); // 转发响应
                } catch (IOException ex) {
                    ex.printStackTrace();
                }
            }

        }

[sheen7758]

结贴!