Rhino 组件及其容器的安全性
假设我有一个实体 Product ，并且每个产品都有一个 Category （如category_id ， cat_name ）。假设我在 Category 上建立了操作 /Category/Read 的权限， 以及操作 /Product/Read on Product 的权限。 /Product/Read操作的IsAllow是否由产品的权限和类别的权限共同决定？
要求是某些用途只能看到部分类别，而不是全部。 如果用户看不到某个类别，则该用户也将看不到与该类别关联的所有产品。
我应该如何在 Rhino Security 中实现这一点？
Suppose I have an entity Product ,and each product has a Category (which as category_id , cat_name ). Suppose I build permission of operation /Category/Read on Category ,
and permission of operation /Product/Read on Product .
Will the IsAllow of operation /Product/Read be determined by both permission on the product and permission of Category ?
the requirement is that some uses should only see some of the categories but not all .
if a user cannot see a category , then all products that are associated with thee category will be invisible to that user also .
How should I implement this in Rhino Security ?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
不可以，全局、实体组或单个实体都允许授予权限。它不知道该实体的父母或孩子。
您可能应该创建一个实体组并将所有受保护的产品和类别放入其中。
向特权用户授予对实体组的 /Category/Read 和 /Product/Read 权限，并拒绝其他人执行这些操作。
希望这有帮助
No, a permission is allowed either globally, on an entity group, or an individual entity. It doesn't know about parents or children of the entity.
You should probably create an entity group and put all of the protected products and categories in there.
Give privileged users /Category/Read and /Product/Read permission on the entity group and deny those operations to everyone else.
Hope this helps