SharePoint _layouts下自定义程序页面权限管理
在sharepoint中，_layouts下的自定义页面没有特别的权限，只要用户能访问sharepoint站点就可以访问_layouts下的自定义程序页面，现在我们需要给自定义页面做一下权限认证。要求如下：
1）自定义程序页面只为特定的站点服务，如图：
我们的自定义页面只为docs站点服务，只有/docs/_layouts/15/这样的访问路径才是合法的。
2）能访问docs站点的用户不一定就可以访问该页面，所以我们需要给该页面配置一个权限管理的list，如图：
3）有些自定义程序页面比较特殊，比如我们开发一个页面来装在rdl报表，那么这个自定义页面的权限就没有多大的意义了，所以我们给自定义页面加上querystring的识别,如图：同样的一个自定义程序页面querystring不同，可以配置不同的权限
现在来看看我们的实现吧：
protected bool CanAccess
{
get
{
if (SPWebNames != null && SPWebNames.Length > 0)
{
string spwebname = SPContext.Current.Web.Name.ToLower();
bool findwebname = SPWebNames.Any(x => x.ToLower().Equals(spwebname));
if (!findwebname)
{
return false;
}
}
List<string> gpnames = GroupNames;
if (gpnames.Count < 1)
{
return true;
}
else
{
SPUser currentUser = SPContext.Current.Web.CurrentUser;
foreach (string gpname in GroupNames)
{
foreach (SPGroup g in currentUser.Groups)
{
if (g.Name.Trim().Equals(gpname))
{
return true;
}
}
}
return false;
}
}
}
首先看看我们当前的web name是否是在配置的web names，如果不是直接返回为false，如果是就继续检查当前user是否具有指定的权限（当前user是否在指定的组里面）。这个配置我们写在sharepoint list里面，用户第一次访问页面时，我们会往该list插入一条新数据，没有指定特定user group name，然后管理员就可以设置该group names。主要代码如下：
string url = HttpContext.Current.Request.Url.AbsolutePath.ToLower();
if (QueryStringWithPermission)
{
url = HttpContext.Current.Request.Url.PathAndQuery.ToLower() ;
}
string _key = "$LayoutsPageWithPermission$";
.................................................................................................................
lock (_lockObj) //lock to avoid creating more than one cfg list.
{
try
{
list = web.Lists[_key];
}
catch
{
}
if (list == null)
{
web.AllowUnsafeUpdates = true;
Guid listId = web.Lists.Add(_key, "List for config , never delete this list.", SPListTemplateType.GenericList);
list = web.Lists[listId];
SPView view = list.DefaultView;
SPViewFieldCollection viewFields = view.ViewFields;
string fieldname = list.Fields.Add("GroupName", SPFieldType.Text, false);
SPField field = list.Fields.GetFieldByInternalName("GroupName");
viewFields.Add(field);
view.Update();
list.Update();
}
SPListItemCollection listitems = list.Items;
foreach (SPListItem spitem in listitems)
{
if (spitem["Title"].ToString().Equals(url))
{
spem = spitem;
break;
}
}
if (spem == null)
{
web.AllowUnsafeUpdates = true;
SPListItemCollection items = list.Items;
SPListItem item = items.Add();
item["Title"] = url;
item["GroupName"] = string.Empty;
item.Update();
spem = item;
}
..................................................................
List<string> groups = new List<string>();
if (spem["GroupName"] == null)
{
return groups;
}
string str = spem["GroupName"].ToString();
groups.AddRange(str.Split(new string[] { ",", ";" }, StringSplitOptions.RemoveEmptyEntries));
return groups;
这里我们首先去读取list，如果该list不存在就创建该list，然后往该list中插入数据，如果list存在那么检查对应的url是否存在不存在 就插入数据，最后返回指定的group names。
最后调用的代码如下：
protected override void OnInit(EventArgs e)
{
base.OnInit(e);
this.SPWebNames = new string[] { "docs" };
this.QueryStringWithPermission = true;
}
运行效果如图：
详细的代码如下：
namespace Microsoft.SharePoint.WebControls { using Microsoft.SharePoint; using Microsoft.SharePoint.WebControls; using System; using System.Collections.Generic; using System.Linq; using System.Text; using System.Threading.Tasks; using System.Web; public class LayoutsPageWithPermission : LayoutsPageBase { #region Property private static object _lockObj = new object(); private List<string> GroupNames { get { string url = HttpContext.Current.Request.Url.AbsolutePath.ToLower(); if (QueryStringWithPermission) { url = HttpContext.Current.Request.Url.PathAndQuery.ToLower() ; } string _key = "$LayoutsPageWithPermission$"; SPList list = null; SPSite siteColl = SPContext.Current.Site; SPWeb site = SPContext.Current.Web; SPItem spem = null; SPSecurity.RunWithElevatedPrivileges(delegate() { using (SPSite edsiteColl = new SPSite(siteColl.ID)) { using (SPWeb web = edsiteColl.OpenWeb(site.ID)) { lock (_lockObj) //lock to avoid creating more than one cfg list. { try { list = web.Lists[_key]; } catch { } if (list == null) { web.AllowUnsafeUpdates = true; Guid listId = web.Lists.Add(_key, "List for config , never delete this list.", SPListTemplateType.GenericList); list = web.Lists[listId]; SPView view = list.DefaultView; SPViewFieldCollection viewFields = view.ViewFields; string fieldname = list.Fields.Add("GroupName", SPFieldType.Text, false); SPField field = list.Fields.GetFieldByInternalName("GroupName"); viewFields.Add(field); view.Update(); list.Update(); } SPListItemCollection listitems = list.Items; foreach (SPListItem spitem in listitems) { if (spitem["Title"].ToString().Equals(url)) { spem = spitem; break; } } if (spem == null) { web.AllowUnsafeUpdates = true; SPListItemCollection items = list.Items; SPListItem item = items.Add(); item["Title"] = url; item["GroupName"] = string.Empty; item.Update(); spem = item; } } } } }); List<string> groups = new List<string>(); if (spem["GroupName"] == null) { return groups; } string str = spem["GroupName"].ToString(); groups.AddRange(str.Split(new string[] { ",", ";" }, StringSplitOptions.RemoveEmptyEntries)); return groups; } } protected bool CanAccess { get { if (SPWebNames != null && SPWebNames.Length > 0) { string spwebname = SPContext.Current.Web.Name.ToLower(); bool findwebname = SPWebNames.Any(x => x.ToLower().Equals(spwebname)); if (!findwebname) { return false; } } List<string> gpnames = GroupNames; if (gpnames.Count < 1) { return true; } else { SPUser currentUser = SPContext.Current.Web.CurrentUser; foreach (string gpname in GroupNames) { foreach (SPGroup g in currentUser.Groups) { if (g.Name.Trim().Equals(gpname)) { return true; } } } return false; } } } protected string CurrentUserName { get { string userName = SPContext.Current.Web.CurrentUser.LoginName; if (userName.Contains("|")) { userName = userName.Split(new char[] { '|' }, StringSplitOptions.RemoveEmptyEntries)[1]; } return userName; } } public bool QueryStringWithPermission { set; get; } public string[] SPWebNames { set; get; } #endregion protected void RedirectAccessDenied() { Uri uri = HttpContext.Current.Request.Url; int index = uri.AbsoluteUri.IndexOf("/_layouts"); string urlprfx = uri.AbsoluteUri.Substring(0, index); string url = urlprfx + "/_layouts/15/AccessDenied.aspx?Source=" + uri.OriginalString; HttpContext.Current.Response.Redirect(url); } protected override void OnLoad(EventArgs e) { base.OnLoad(e); if (!CanAccess) { RedirectAccessDenied(); } } } }
