在 ASP.NET DD 中动态使表/列只读/隐藏
我正在根据文章 保护动态数据预览 4 刷新。系统包含一种附加权限类型：“如果记录不属于用户，则拒绝对记录/字段的操作”。
如果用户只能读取自己的对象，我们需要在列表中始终启用过滤器并在详细信息中检查权限。如果用户只能写入自己的对象，我们需要检查编辑和删除中的权限，从列表中的某些行中删除“编辑/删除”链接，将“用户”字段设为只读并在插入中提供其值。我还没有考虑过这种列级权限。
所以，正如我此时所看到的，主要问题是：有太多地方需要进行相同的检查（我什至没有想到恶意用户会制作 POST 数据）。另外，我无法在插入中以相同的只读方式创建一个字段，并具有一个显示并保存到数据库的值（我不想将其放置在模型部分类中，因为我认为已经有太多地方了需要进行编辑才能实现此功能）。
- 是否有一个地方可以根据对象值拒绝对对象的读取或写入操作？
- 如何为该字段提供默认值，以便它将显示在插入页面上，插入到数据库中并且用户在插入之前无法更改？
I'm making a security permission system for a Dynamic Data site based on the article Securing Dynamic Data Preview 4 Refresh. The system contains an additional permission kind: "deny an operation for a record/field if a record is not owned by an user".
If an user can read only own objects, we need to have an always enabled filter in List and check permissions in Details. If an user can write only own objects, we need to check permissions in Edit and Delete, remove "Edit/Delete" links from some rows in List, make "User" field readonly and provide its value in Insert. I didn't think about column-level permissions of this kind yet.
So, the main problem, as I see at this moment: too many places to place the same checks (I didn't even think of malicious user crafting POST data). Also I couldn't make make a field in Insert at the same readonly and having a value which is displayed and saved to DB (I don't want to place that in the model partial classes because I think that there are already too many places that need to be edited to implement this functionality).
- Is there a single place to deny a read or write operation with an object depending on the object value?
- How can I provide a default value to the field, so that it will be shown on the Insert page, inserted to the DB and couldn't be changed by the user before inserting?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
以下假设您使用 LINQ to SQL。
读取
据我所知，没有比向所有相关 LinqDataSource 控件添加过滤器更简单的限制读取的方法了。如果您能够一般地实现过滤器，则可以编写一个 QueryCreated 处理程序，然后添加一行将您的自定义处理程序注册到所有页面模板。
写入
在动态数据元数据中，将 OnValidate 部分方法添加到所有相关表。如果当前用户不允许 ChangeAction 给定的记录，抛出异常。您仍然需要更新所有页面模板以隐藏用户无权访问的 UI 元素，但至少您可以放心，在某些意外情况下可能发生的最坏情况是用户看到错误页面。
也许看看添加 OnCreated 和 OnValidate 部分方法的某种组合。另请参阅：这个答案。
The following assumes you're using LINQ to SQL.
Reads
I know of no simpler way to restrict reads than to add a filter to all the relevant LinqDataSource controls. If you are able to implement your filter generally, you can write one QueryCreated handler, then add a single line registering your custom handler to all the page templates.
Writes
In the Dynamic Data metadata, add an OnValidate partial method to all the relevant tables. If the current user is not allowed to ChangeAction the given record, throw an exception. You will still have to update all the page templates to hide UI elements that the user does not have access to, but at least you can rest assured that the worst that could happen in some unexpected case is that the user sees an error page.
Perhaps look at some combination of adding an OnCreated and OnValidate partial methods. See also: this answer.