权限控制与菜单加载-CSDN博客

本文链接：https://blog.csdn.net/masuwen/article/details/53203744

本文介绍了一种基于Velocity模板引擎的权限控制方案，利用含有多个用户ID的字段进行权限判断，实现了用户可见菜单项的动态加载。同时提供了两种不同的权限验证方法：一种是通过包含检查，另一种是使用SQL模糊匹配。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

////////注意选择人员可有多个，并以","隔开存入数据库字段中。velocity中权限登录用户id包含在那个以","隔开的字段中就可以了。简单.

   当前用户：【${AccessUser.getUserName()}】
               <div class="menu_dropdown bk_2">
                   #loadsub('')
                   #macro(loadsub $parentId)
                   #foreach($channel in ${t_work.getChannelAll("$parentId")} )
                   #set($channels = ${t_work.getChannelAll("$channel.channelId")})
                       #set($checkChannel="")
                       #set($checkChannel=$!channel.reader)
                            ##可查看人权限
                           #if($!channel.hidden==1&&$checkChannel.contains("${AccessUser.getUserId()}"))
                                   #if($channels.size()>0)
                                       <dl>
                                            <dt>   <i id="$!{velocityCount}" class="fa fa-folder-o fa-color"></i>
                                                   $channel.channelName<i class="fa fa-plus-square-o fa-color"></i>
                                            </dt>
                                            <dd>
                                            <li>#loadsub($channel.channelId)</li>
                                            </dd>
                                       </dl>
                                    #else
                                       <li><a id="$!channel.channelId" _href="$!base/private/information/list.jhtml?channelId=$!channel.channelId" href="javascript:void(0)">
                                           <i class="fa fa-circle-o fa-color"></i>$!channel.channelName</a>
                                       </li>
                                   #end
                           #end
                   #end
       #end
           </div>

</div>

toolbox.xml中的getChannelAll()方法,

public List<CmsInfoChannelEntity> getChannelAll(String channelId){
return WorkFactory.getCmsInfoChannelRemote().findByParent(channelId);
}

java类中的实现

	public List<CmsInfoChannelEntity> findChildByParent(String parentId) {
		String query = null;
		if (StringUtils.isEmpty(parentId)) {
			query = "select s from CmsInfoChannelEntity s where s.channelParentId is null order by s.channelLevel,s.channelSort ";
			return this.findList(query);
		}
		query = "select s from CmsInfoChannelEntity s where s.channelParentId=?1 order by s.channelLevel,s.channelSort ";
		return this.findList(query, parentId);
	}

///////另外一种方法是不使用velocity的包含contains；

/////而是使用like模糊匹配

public List<CmsInfoChannelEntity> channellistByCurrentUserId(String channelId,String currentUserId) {

String sql = new String("select s from CmsInfoChannelEntity s where 1=1 ");

if(!StringUtils.isEmpty(currentUserId)){

sql+=" and s.reader like '%"+currentUserId+"%'";

}

if(!StringUtils.isEmpty(channelId)){

sql+=" and s.channelId ='"+channelId+"'";

}

return this.cmsInfoChannelDao.findList(sql);

}