securityfilter.java

一个公司管理系统,用简单的htmlt要servlet做的,有增.查.改功能.适合同学学习交流.

package com.tarena.servlet.filter;

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

import com.tarena.vo.Users;

public class SecurityFilter implements Filter {

	public void destroy() {

	}

	public void doFilter(ServletRequest request, ServletResponse response,
			FilterChain filterchain) throws IOException, ServletException {
		
		//转换类型
		HttpServletRequest req  = (HttpServletRequest)request;
		HttpServletResponse res = (HttpServletResponse) response;
		
		HttpSession session = req.getSession(false);
		if(session == null) {
			res.sendRedirect("fail.html");
			return;
		}
		
		Users user = (Users)session.getAttribute("user");
		if(user != null) {
			String action = request.getParameter("action");
			boolean hasPrivilige = checkPrivilige(action, user.getRole());
			
			if(!hasPrivilige) {
				System.out.println("current user :" + user.getUsername() + "'s role : " + user.getRole());
				res.sendRedirect("noauthorization.html");
				return;
			}
		}
		
		filterchain.doFilter(req, res);

	}

	public void init(FilterConfig arg0) throws ServletException {

	}
	
	private boolean checkPrivilige(String action, String role) {
		if(role != null && role.equals("admin")) {
			return true;
		}
		if(action == null) 
			return false;
		
		if(!action.equals("list") && !role.equals("admin")) {
			return false;
		}
		
		return true;
	}

}