crules.cs

C#编写的网站附件安全设置

using System;
using System.Collections;
using System.Data;
using System.IO;
using System.Text.RegularExpressions;
namespace ENet.HttpModule
{
	/// <summary>
	/// CRules 的摘要说明。
	/// </summary>
	public class CRules
	{
		public CRules()
		{
			//
			// TODO: 在此处添加构造函数逻辑
			//
		}
		public static int CheckAttachRight(string SessionID,string RequestR,string UserID,string User_JgjgCode,
			ref string sMessage,Hashtable hsRules)
		{
			string RequestURL=RequestR;//"http://www.szse.cn/aaa/Jgxx_23_2004.doc";//Request.FilePath;
			int LastLoc=RequestURL.LastIndexOf("/");		


			int iResult=-1;
			try
			{
				if(LastLoc!=-1&&LastLoc!=RequestURL.Length-1)
				{
					string fileName=RequestURL.Substring(LastLoc+1,RequestURL.Length-LastLoc-1);
					if(fileName.IndexOf(".")!=-1)
					{
						FileInfo fi=new FileInfo(fileName);
						//Hashtable hsRules=getRules();
						string ParFileName=getParentFileName(fi.Name,hsRules);
						if(ParFileName!="")
						{
							string StrSql=hsRules[ParFileName].ToString();
							if(StrSql!="")
							{
								if(StrSql=="-1")
								{
									iResult=0;//被控制，且没有访问权利
								}
								else if(StrSql=="-2")
								{
									if(SessionID=="")
									{
										iResult=0;
									}
									else
									{
										if(fi.Name.IndexOf(SessionID)==-1)
										{
											iResult=0;
										}
										else
										{
											iResult=1;
										}
									}									
								}
								else
								{
									if(UserID=="")
									{
										iResult=0;//被控制，且没有访问权利
									}
									else
									{
										StrSql=StrSql.Replace("\r"," ");
										StrSql=StrSql.Replace("\t"," ");
										StrSql=StrSql.Replace("\n"," ");

										StrSql=StrSql.Replace("<%jgjg%>",User_JgjgCode);
										StrSql=StrSql.Replace("<%userid%>",UserID);
										StrSql=StrSql.Replace("<%filename%>",fi.Name);
										DataTable dt=CPublic.GetDataTable(StrSql);
										if(dt.Rows.Count>0)								
											iResult=1;//被控制，且有访问权利
										else
											iResult=0;//被控制，且没有访问权利
									}									
								}								
							}						
						}					
					}				
				}
			}
			catch
			{}
			switch(iResult)
			{
				case -1:
					sMessage="文件不受权限控制";
					break;
				case 0:
					sMessage="被控制，且没有访问权利";
					break;
				case 1:
					sMessage="被控制，且有访问权利";
					break;
			}
			return iResult;
		}
		public static Hashtable getRules()
		{
			try
			{
				string StrSql="SELECT * FROM E3_Base_Attach_Right_Rules";
				DataTable dt=CPublic.GetDataTable(StrSql);
				Hashtable hs=new Hashtable();
				for(int i=0;i<dt.Rows.Count;i++)
				{
					hs.Add(dt.Rows[i]["fileName"].ToString(),dt.Rows[i]["RulesSQL"].ToString());
				}
				return hs;
			}
			catch
			{
				return null;
			}			
		}
		public static string getParentFileName(string fileName,Hashtable hsRules)
		{
			string sReturn="";
			try
			{				
				foreach(DictionaryEntry entry in hsRules)
				{
					if(checkRegex(fileName,entry.Key.ToString()))
					{
						sReturn=entry.Key.ToString();
						break;
					}
				}
			}
			catch
			{				
			}
			return sReturn;			
		}
		public static bool checkRegex(string fileName,string RulesFileName)
		{
			try
			{
				fileName=fileName.ToUpper();
				string pattern = RulesFileName.ToUpper();//@"^JGXX_23_.*\.doc$";
				pattern=pattern.Replace(".",@"\.");
				pattern=pattern.Replace("*",@".*");
				Regex reg = new Regex(pattern);
				reg.IsMatch(fileName);
				return reg.IsMatch(fileName);
			}
			catch
			{
				return false;
			}			
		}
	}
}