permisionbean.java

来自「java开发的办公系统 1.系统管理 (地区管理,部门管理,菜单管理,用户管理」· Java 代码 · 共 186 行

package com.vere.manager.authorize;

	import java.sql.*;
	import java.util.*;

	import com.vere.exception.*;
	import com.vere.db.*;
	import com.vere.manager.item.*;

	import java.io.*;
	import javax.servlet.*;
	import javax.servlet.http.*;
	import com.vere.util.*;


	public class PermisionBean {
		private ResultSet rs=null;
		private Access access = null;
		
		public PermisionBean()
		{
			try {
				access=new Access();
				access.getConnection();
			}
			catch(Exception e) {
				System.out.println(e.toString());
			}
		}
		
		/**
		 * @author	Administrator
		 * @param	username:用户名，psw: 密码
		 * @return	UsersItem:用户对象
		 * @see		用户登陆
		 */
		/*public UsersItem checkLogin(String username,String psw) throws UserException{
	         try {
	             if(username.equals("") || psw.equals(""))
	                 throw new UserException("用户名或密码不能空。");
	             if(username.indexOf("'") != -1 || username.indexOf("\"") != -1 || username.indexOf(",") != -1 || username.indexOf("\\") != -1)
	                 throw new UserException("用户名不能包括 ' \" \\ , 等非法字符。");
	             if(psw.indexOf("'") != -1 || psw.indexOf("\"") != -1 || psw.indexOf("*") != -1 || psw.indexOf("\\") != -1)
	                 throw new UserException("密码不能包括 ' \" \\ * 等非法字符。");
	             if(username.startsWith("　") || psw.startsWith("　"))
	                 throw new UserException("用户名或密码中不能用空格。");

	             String sql="select * from users where username='"+username+"' and psw='"+psw+"' ";
	             rs = executeQuery(sql);
	             UsersItem item=new UsersItem();
	             if(rs.next()){
	                 item.setId(rs.getString("id"));
	                 item.setUsername(rs.getString("username"));
	                 item.setPsw(rs.getString("psw"));
	                 item.setName(rs.getString("name"));
	             }
	             
	             return item;
	         }catch(SQLException e){
	             System.out.print(e.toString());
	             return null;
	         }
	    }*/
		
		/**
		 * @author	Administrator
		 * @param	username:用户名，psw: 密码
		 * @return	UsersItem:用户对象 用户和部门一对多关系,用户和菜单一对多关系，用户和按钮一对多关系
		 * @see		用户登陆
		 */
		public SessionFactory checkLogin(String username,String psw) throws UserException{
	         try {
	             if(username.equals("") || psw.equals(""))
	                 throw new UserException("用户名或密码不能空。");
	             if(username.indexOf("'") != -1 || username.indexOf("\"") != -1 || username.indexOf(",") != -1 || username.indexOf("\\") != -1)
	                 throw new UserException("用户名不能包括 ' \" \\ , 等非法字符。");
	             if(psw.indexOf("'") != -1 || psw.indexOf("\"") != -1 || psw.indexOf("*") != -1 || psw.indexOf("\\") != -1)
	                 throw new UserException("密码不能包括 ' \" \\ * 等非法字符。");
	             if(username.startsWith("　") || psw.startsWith("　"))
	                 throw new UserException("用户名或密码中不能用空格。");

	             String sql="select a.*,b.name as departmentName,c.name as area_name  from "+T.MANAGER_USERS+" as a,"+T.MANAGER_DEPARTMENT+" as b,"+T.MANAGER_AREA+" as c  where a.department_id=b.id and a.username='"+username+"' and a.area_id=c.id  and a.psw='"+psw+"' ";
	             rs = executeQuery(sql);
				 SessionFactory sessionFactory=new SessionFactory();
				 Manager_usersItem userItem=new Manager_usersItem();
	             if(rs.next()){
					userItem.setId(rs.getString("id"));
					userItem.setUsername(rs.getString("username"));
					userItem.setPsw(rs.getString("psw"));
					userItem.setName(rs.getString("name"));
					userItem.setSex(rs.getString("sex"));
					userItem.setIp(rs.getString("ip"));
					userItem.setDepartment_id(rs.getString("department_id"));
					userItem.setDepartment_nodepath(rs.getString("department_nodepath"));
					userItem.getManager_departmentItem().setName(rs.getString("departmentName"));
					userItem.setArea_id(rs.getString("area_id"));
					userItem.setArea_nodepath(rs.getString("area_nodepath"));
					Manager_areaItem areaItem=new Manager_areaItem();
					areaItem.setId(userItem.getArea_id());
					areaItem.setName(rs.getString("area_name"));
					userItem.setManager_areaItem(areaItem);
				}
					sessionFactory.setManager_usersItem(userItem);

				 //用户角色权限
				List menu_roleList=sessionFactory.getMenu_roleList();
				sql="select b.* from "+T.MANAGER_ROLE+" as a,"+T.MANAGER_MENU_ROLE+" as b where a.id=b.roleid and  ','+a.contain_user+',' like '%,"+username+",%' ";
				rs = executeQuery(sql); 
				while(rs.next()){
					Manager_menu_roleItem item=new Manager_menu_roleItem();
					item.setMenuid(rs.getString("menuid"));
					item.setRoleid(rs.getString("roleid"));
					item.setFunc_id(rs.getString("func_id"));
					sessionFactory.getMenu_roleList().add(item);
				 }
				 //用户权限
				List menu_userList=sessionFactory.getMenu_userList();
				sql="select * from "+T.MANAGER_MENU_USER+"  where  username = '"+username+"' ";
				rs = executeQuery(sql); 
				while(rs.next()){
					Manager_menu_userItem item=new Manager_menu_userItem();
					item.setMenuid(rs.getString("menuid"));
					item.setUsername(rs.getString("username"));
					item.setFunc_id(rs.getString("func_id"));
					sessionFactory.getMenu_userList().add(item);
				 }
				 
	             return sessionFactory;
	         }catch(SQLException e){
	             System.out.print(e.toString());
	             return null;
	         }
	    }
	    
	
		
		/**
		 * @author	Administrator
		 * @param	sql:要更新的sql 语句
		 * @return	boolean:如果执行成功返回true,否则返回false
		 * @see		执行更新一条sql 语句
		 */
		public boolean executeUpdate(String sql){
			try{
				return access.executeUpdate(sql);
			}
			catch(Exception e){
				System.out.println(e.toString());
				return false;
			}
		}

		/**
		 * @author	Administrator
		 * @param	sql:要查询的sql 语句
		 * @return	boolean:如果执行成功返回true,否则返回false
		 * @see		执行查询一条sql 语句
		 */
		public ResultSet executeQuery(String sql){
			try
			{
				rs=access.executeQuery(sql);
				return rs;
			}
			catch(Exception e){
				System.out.println(e.toString());
				return null;
			}
		}

		/**
		 * @author	Administrator
		 * @param	无
		 * @return	无
		 * @see		关闭数据库操作对象
		 */
		public void DBclose(){
			try {
				access.DBclose(rs);
			}
			catch(Exception e) {
				System.out.println(e.toString());
			}
		}
	}