55 lines
1.8 KiB
C#
55 lines
1.8 KiB
C#
using System;
|
|
using System.Web;
|
|
using System.Web.Helpers;
|
|
using System.Web.Mvc;
|
|
using System.Web.Routing;
|
|
using EnVisage.Code.BLL;
|
|
|
|
namespace EnVisage.Code
|
|
{
|
|
public class AreaSecurityAttribute : AuthorizeAttribute
|
|
{
|
|
public Areas area { get; set; }
|
|
public AccessLevel level { get; set; }
|
|
|
|
protected override bool AuthorizeCore(HttpContextBase httpContext)
|
|
{
|
|
var isAuthorized = base.AuthorizeCore(httpContext);
|
|
if (!isAuthorized)
|
|
{
|
|
return false;
|
|
}
|
|
|
|
var userId = HttpContext.Current.User.Identity.GetID();
|
|
AccountManager manager = new AccountManager(null);
|
|
manager.SetLoginDates(userId);
|
|
return SecurityManager.CheckSecurityObjectPermission(area, level);
|
|
}
|
|
|
|
protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
|
|
{
|
|
base.HandleUnauthorizedRequest(filterContext);
|
|
|
|
if (filterContext.RequestContext.HttpContext.User.Identity.IsAuthenticated)
|
|
{
|
|
filterContext.Result = new RedirectToRouteResult(new RouteValueDictionary(new { controller = "Home", action = "AccessDenied" }));
|
|
}
|
|
}
|
|
}
|
|
|
|
[AttributeUsage(AttributeTargets.Method | AttributeTargets.Class, AllowMultiple = false, Inherited = true)]
|
|
public class ValidateJsonAntiForgeryTokenAttribute : FilterAttribute, IAuthorizationFilter
|
|
{
|
|
public void OnAuthorization(AuthorizationContext filterContext)
|
|
{
|
|
if (filterContext == null)
|
|
{
|
|
throw new ArgumentNullException("filterContext");
|
|
}
|
|
|
|
var httpContext = filterContext.HttpContext;
|
|
var cookie = httpContext.Request.Cookies[AntiForgeryConfig.CookieName];
|
|
AntiForgery.Validate(cookie != null ? cookie.Value : null, httpContext.Request.Headers["__RequestVerificationToken"]);
|
|
}
|
|
}
|
|
} |