PandaJS instructions for use (1.7): Permission control and data verification

PandaJS usage (1.7): Permission control and data verification use the proxy object mentioned in the previous article to implement permission control and data verification. The idea of permission control is to intercept calls to page. * and api. * and use the records recorded in the session... SyntaxHighlighter. all ();

PandaJS instructions for use (1.7): Permission control and data verification

Using the proxy object mentioned in the previous article, we can also implement permission control and data verification.
The idea of permission control is to intercept calls to page. * and api. *, and use the user role information recorded in the session for permission check;
Data Verification code is reused to perform dual checks on the client and server.

Permission Control

The call to page. * is used as an example. The basic idea is:
1. Use the regular expression/^ page./And/^ api./to match the method call to be blocked
2. Get the req (ServletHttpRequest) in the Parameter)
3. Get the User Role in the session
4. If the user's role is admin, the corresponding page is displayed; otherwise, the login page is displayed.

Javascript code
(Function (){
Var log = panda. log ("proxy. security ");
 
Proxy. security = {priority: 80 };
 
// Perform permission control on page. * calls
Proxy. security. page = {
Priority: 100,
Expr:/^ page ./,
Func: function (name, method, args ){
// Obtain the second parameter of the method, that is, req
Var req = args [1];
 
// Read the role in the session. The returned value is java. lang. String.
// Convert null strings into strings in JavaScript
Var role = req. session. getAttribute ("user. role") + "";
 
// If the role is "admin", the corresponding page is displayed.
// Otherwise, the logon page is displayed.
If (role = "admin "){
Return this [method]. apply (this, args );
} Else {
Log.info ("Redirect to login page .");
Return panda. render ("login ");
}
}
}
 
// Use a similar method to control the permissions of api. * calls.
Proxy. security. api = {...}
}());

For simplicity, only the admin role is included here.
In addition, you also need to create the file webapp/login.html (login page) webspp/js/login. js (client JS that sends the user name and password to the server) and scripts/api/auth. js (login user name and password verification). For details, see the corresponding file in the attachment.

Start the mongod and PandaJS projects (see the attachment) and enter http: // localhost/. The logon page is displayed. You can also see "Redirect to login page" in the console output (or log..
Enter the user name and password, and click Sign in. the user list is displayed.

Data Verification

First, write the validator object commonly used on the server side and in the browser:

Webapp/js/both/validator. js
Javascript code
Validator = {};
 
// Check the exception information
Validator. USER_INVALID = "Invalid user data .";
Validator. USER_NAME_EMPTY = "Name cannot be empty .";
Validator. USER_NAME_TOO_LONG = "Name cannot be longer than 50 .";
Validator. USER_NAME_FORMAT = "Name format is not conrrect .";
Validator. USER_DESC_EMPTY = "Description cannot be empty .";
Validator. USER_DESC_TOO_LONG = "Description cannot be longer than 50 .";
 
// Method for checking the user object
Validator. validateUser = function (user ){
// Parameter type error, which may be a malicious attack
If (typeof user. name! = "String"
| Typeof user. desc! = "String "){
Return {success: false, error: validator. USER_INVALID };
}
 
// Name is empty
If (! User. name ){
Return {success: false, error: validator. USER_NAME_EMPTY };
}
 
// The name is too long.
If (user. name. length> 50 ){
Return {success: false, error: validator. USER_NAME_TOO_LONG };
}
 
// Name format check
If (! /^ [A-z] [A-z0-9. _] * $/. test (user. name )){
Return {success: false, error: validator. USER_NAME_FORMAT };
}
 
// Desc is empty
If (! User. desc ){
Return {success: false, error: validator. USER_DESC_EMPTY };
}
 
// Desc is too long
If (user. desc. length> 50 ){
Return {success: false, error: validator. USER_DESC_TOO_LONG };
}
 
// Extract name and desc, because there may be other unnecessary attributes in the object.
Var data = {name: user. name, desc: user. desc}
Return {success: true, data: data };
}

This code is used in the proxy. validation object on the server side and the save (...) on the browser side.
Client verification is to give users faster feedback, and server verification is to avoid malicious attacks.
The code is implemented as follows:

Scripts/app/proxy/validation. js
Javascript code
(Function (){
Var log = panda. log ("proxy. validation ");
 
Proxy. validation = {priority: 60 };
 
// Check user data when creating or updating a user
Proxy. validation. saveUser = {
Priority: 100,
Expr:/^ dbo. users. (add | update) $ /,
Func: function (name, method, args ){
Var validated = validator. validateUser (args [0]);
 
If (! Validated. success ){
Log.info (validated. error );
Throw validated. error;
}
 
Args [0] = validated. data;
 
Return this [method]. apply (this, args );
}
};
 
// When creating a user, check whether the user already exists
Proxy. validation. addUser = {
Priority: 80,
Expr:/^ dbo. users. add $ /,
Func: function (name, method, args ){
Var user = args [0];
 
If (this. exists (user. name )){
Var msg = "The user already exists .";
Log.info (msg );
Throw msg;
}
 
Return this [method]. apply (this, args );
}
};
}());

Webapp/js/index. js
Javascript code
$ (Function (){
// Other code, omitted
 
Function save (action, user ){
// Verify the validity of user data
Var validated = validator. validateUser (user );
 
If (! Validated. success ){
$ ("# Error" cmd.html (validated. error). show ();
Return;
}
 
// Send a request to the server
Var req = {action: action, params: validated. data };
Panda. post (req, show, function (error ){
$ ("# Error" 2.16.html (error). show ();
});
}
 
Function show (users ){...}
});

Check whether the input is null and whether the length and format of the input parameters are shared. Check whether the user's logic exists only on the proxy object on the server side.
In addition, this in the proxy object func represents the intercepted object, so we can. validation. the saveUser calls dbo. exists (name) to check whether the user already exists.
In addition, you also need to implement dao. users. exists (name) method, and add the webapp/js/both/validator in index.html. js reference. For details, see the corresponding file in the attachment.

Summary

1. We can use the proxy object to intercept methods for permission and Data check.
2. We can put the code shared by the server and the browser under the both directory.
3. this in the proxy object func indicates the intercepted object.

 

This article is from "Xiao Xiaoxing's blog"