问题过滤ObjectQuery.include权限业务逻辑方法

发布于 2024-12-13 13:30:58 字数 815 浏览 0 评论 0原文

我在 BL 和实体框架 DAL 之间创建了中间件层，用于通过应用程序中的用户权限业务逻辑过滤数据。我的层实现了 IObjectSet，它具有“无过滤对象集”的实例，并且只要使用对象集，过滤器表达式就会运行。所有工作都有效，而不是“包含”方法。我找到了一个解决方案，该解决方案创建一个扩展方法，将“无过滤的 ObjectSet”转换为 ObjectQuery 并使用 ObjectQuery.Include 方法，但此解决方案可能会导致绕过权限过滤。

public IQueryable<TEntity> Include<TJoin>(string path)
    {
        if (_nonAuthorizedObjectSet is ObjectQuery<TEntity>)
        {
            var result = ((ObjectQuery<TEntity>)_nonAuthorizedObjectSet).Include(path);
            return result as IQueryable<TEntity>;
        }
    }

例如：

表名称“Items”具有列 {Item_Id,Owner,Item_Type_Id} 该表有一个权限逻辑，即用户只能看到Owner==用户的项目。表“Item_Types”没有权限逻辑。

通过这样做：允许的 DAL。 Items.ToArray() – 仅获取 current_user==Owner 的项目。 Item_Types.include("项目") 问题！！ - 我得到了所有的物品。

谢谢

原文

I created middleware layer between the BL and the Entity Framework DAL for filtering the data by the user permission business logic in the application. My layer implements IObjectSet that have an instance of the "None filtered ObjectSet" and the filter expression is running whenever the ObjectSet is in use. All working grate, instead of the method "Include". I found a solution that create an extension method that convert the "None filtered ObjectSet" to ObjectQuery and use the ObjectQuery.Include method but this solution can cause a bypass of the permission filtering.

public IQueryable<TEntity> Include<TJoin>(string path)
    {
        if (_nonAuthorizedObjectSet is ObjectQuery<TEntity>)
        {
            var result = ((ObjectQuery<TEntity>)_nonAuthorizedObjectSet).Include(path);
            return result as IQueryable<TEntity>;
        }
    }

For example:

Table name "Items" have columns {Item_Id,Owner,Item_Type_Id}
This table have a permission logic that the user can only see the items that the Owner==user.
Table "Item_Types" have no permission logic.

By doing:
PermittedDAL. Items.ToArray() – get only the items that the current_user==Owner.
Item_Types.Include("Items")
Problem!! - I get all the items.

Thanks

分享到QQ

分享到微博