asp.net Forums 之安全
在上一篇文章中，我们讨论了asp.net Forums 之HttpHandler和HttpModule，在这里放这个链接，是因为在本篇文件中需要用到上HttpModule相关的内容。
首先在Web.Config中配制为匿名用户不允许查看相关贴子。
<
location path
=
"
EditPost.aspx
"
>
<
system.web
>
<
authorization
>
<
deny users
=
"
?
"
/>
</
authorization
>
</
system.web
>
</
location
>
<
location path
=
"
PostAttachmentManager.aspx
"
>
<
system.web
>
<
authorization
>
<
deny users
=
"
?
"
/>
</
authorization
>
</
system.web
>
</
location
>
<
location path
=
"
PrivateMessage.aspx
"
>
<
system.web
>
<
authorization
>
<
deny users
=
"
?
"
/>
</
authorization
>
</
system.web
>
</
location
>
<
location path
=
"
Download.aspx
"
>
<
system.web
>
<
authorization
>
<
deny users
=
"
?
"
/>
</
authorization
>
</
system.web
>
</
location
>
<
location path
=
"
License.aspx
"
>
<
system.web
>
<
authorization
>
<
deny users
=
"
?
"
/>
</
authorization
>
</
system.web
>
</
location
>
用户登录时验证用户信息
代码
//
*********************************************************************
//
LoginButton_Click
//
///
<summary>
///
Event handler to handle the login button click event
///
</summary>
//
***********************************************************************/
public
void
LoginButton_Click(Object sender, EventArgs e)
{
User userToLogin
=
new
User();
//
增加返回url by venjiang
string
redirectUrl
=
forumContext.ReturnUrl;
if
(
!
Page.IsValid)
return
;
//
[FRUM-183]增加验证码 by venjiang 2005/10/10
if
(Globals.GetSiteSettings().EnableAntiSpamTextGenerate
&&
Globals.GetSiteSettings().EnableAntiSpamTextGenerateForLogin)
{
if
(antiSpamText.Text
!=
Globals.GetForumsAntiSpamText())
throw
new
ForumException(ForumExceptionType.AntiSpamTextNotMatch);
}
userToLogin.Username
=
username.Text;
userToLogin.Password
=
password.Text;
userToLogin.IPLastLogin
=
Globals.IPAddress;
//
用户代理信息增加 by venjiang 2005/01/21
userToLogin.IPLocation
=
IPScanner.IPLocation(Globals.IPAddress);
userToLogin.Platform
=
Users.GetUsersInfo(forumContext.Context.Request.UserAgent,
1
);
userToLogin.Browser
=
Users.GetUsersInfo(forumContext.Context.Request.UserAgent,
2
);
LoginUserStatus loginStatus
=
Users.ValidUser(userToLogin);
if
(loginStatus
==
LoginUserStatus.Success)
{
//
如果系统设置不允许登录
if
(
!
Globals.GetSiteSettings().AllowLogin)
{
bool
allowed
=
false
;
int
userid
=
Users.FindUserByUsername(userToLogin.Username).UserID;
ArrayList roles
=
Roles.GetRoles(userid);
//
如果是管理员,则设置允许登录
foreach
(Role role
in
roles)
{
if
(role.Name
==
"
Site Administrators
"
||
role.Name
==
"
Global Administrators
"
)
{
allowed
=
true
;
break
;
}
}
//
处理用户登录处理
if
(
!
allowed)
{
throw
new
ForumException(ForumExceptionType.UserLoginDisabled);
}
}
//
FormsAuthentication.SetAuthCookie(userToLogin.Username, autoLogin.Checked);罗田040823
//
根据cookies下拉列表选择项的值设置cookie
SetLoginCookie(userToLogin.Username, autoLogin.SelectedValue);
//
设置返回url
if
(redirectUrl
!=
null
&&
redirectUrl.Length
>
0
)
{
//
增加返回url判断 by venjiang 2005/01/20
//
redirectUrl = (redirectUrl.IndexOf("MessageID") == -1 ? redirectUrl : Globals.GetSiteUrls().Home);
//
修订 by venjiang 2005/03/28
if
((redirectUrl.IndexOf(
"
MessageID
"
)
!=
-
1
)
||
(redirectUrl.IndexOf(Globals.GetSiteUrls().Logout)
!=
-
1
)
||
(redirectUrl.IndexOf(
"
ChangePassword
"
)
!=
-
1
)
||
(redirectUrl.IndexOf(
"
EmailForgottenPassword
"
)
!=
-
1
))
Page.Response.Redirect(Globals.GetSiteUrls().Home,
true
);
else
Page.Response.Redirect(redirectUrl,
true
);
}
else
{
//
Page.Response.Redirect(Globals.ApplicationPath, true);
//
修订 by venjiang 2005/01/20
Page.Response.Redirect(Globals.GetSiteUrls().Home,
true
);
}
}
else
if
(loginStatus
==
LoginUserStatus.InvalidCredentials)
{
//
Invalid Credentials
throw
new
ForumException(ForumExceptionType.UserInvalidCredentials,
"
UserName:
"
+
userToLogin.Username);
}
else
if
(loginStatus
==
LoginUserStatus.AccountPending)
{
//
Account not approved yet
throw
new
ForumException(ForumExceptionType.UserAccountPending);
}
else
if
(loginStatus
==
LoginUserStatus.AccountBanned)
{
//
Account banned
throw
new
ForumException(ForumExceptionType.UserAccountBanned, userToLogin.Nickname
+
"
(
"
+
userToLogin.Username
+
"
)
"
);
}
else
if
(loginStatus
==
LoginUserStatus.AccountDisapproved)
{
//
Account disapproved
throw
new
ForumException(ForumExceptionType.UserAccountDisapproved, userToLogin.Nickname
+
"
(
"
+
userToLogin.Username
+
"
)
"
);
}
else
if
(loginStatus
==
LoginUserStatus.UnknownError)
{
//
Unknown error because of miss-syncronization of internal data
throw
new
ForumException(ForumExceptionType.UserUnknownLoginError);
}
}
public
static
bool
AuthenticateUser(User userToLogin)
{
LoginUserStatus loginStatus
=
Users.ValidUser(userToLogin);
if
(loginStatus
==
LoginUserStatus.Success)
{
//
Are we allowing login?
//
TODO -- this could be better optimized
if
(
!
Globals.GetSiteSettings().AllowLogin)
{
bool
allowed
=
false
;
int
userid
=
Users.FindUserByUsername(userToLogin.Username).UserID;
ArrayList roles
=
Roles.GetRoles(userid);
foreach
(Role role
in
roles)
{
if
(role.Name
==
"
Site Administrators
"
||
role.Name
==
"
Global Administrators
"
)
{
allowed
=
true
;
break
;
}
}
//
Check the user is in the administrator role
if
(
!
allowed)
{
throw
new
ForumException(ForumExceptionType.UserLoginDisabled);
}
}
return
true
;
}
else
{
if
(loginStatus
==
LoginUserStatus.InvalidCredentials)
{
//
Invalid Credentials
throw
new
ForumException(ForumExceptionType.UserInvalidCredentials, userToLogin.Username);
}
else
if
(loginStatus
==
LoginUserStatus.AccountPending)
{
//
Account not approved yet
throw
new
ForumException(ForumExceptionType.UserAccountPending);
}
else
if
(loginStatus
==
LoginUserStatus.AccountBanned)
{
//
Account banned
throw
new
ForumException(ForumExceptionType.UserAccountBanned, userToLogin.Username);
}
else
if
(loginStatus
==
LoginUserStatus.AccountDisapproved)
{
//
Account disapproved
throw
new
ForumException(ForumExceptionType.UserAccountDisapproved, userToLogin.Username);
}
else
if
(loginStatus
==
LoginUserStatus.UnknownError)
{
//
Unknown error because of miss-syncronization of internal data
throw
new
ForumException(ForumExceptionType.UserUnknownLoginError);
}
return
false
;
}
}
//
用户验证
///
<summary>
///
验证用户有效性
///
</summary>
///
<param name="user">
///
要验证的用户,用户名和密码属性是必须的.
///
</param>
///
<returns>
返回当前用户登录状态
</returns>
public
static
LoginUserStatus ValidUser(User user)
{
return
ValidUser(user,
false
);
}
///
<summary>
///
验证用户登录状态
///
</summary>
///
<param name="user">
要验证的用户
</param>
///
<param name="isRequestFromWebService">
是否来自Web服务请求
</param>
///
<returns>
返回用户登录状态
</returns>
//
登录验证-1
public
static
LoginUserStatus ValidUser(User user,
bool
isRequestFromWebService)
{
ForumsDataProvider dp
=
ForumsDataProvider.Instance();
//
Lookup account by provided username
//
查找用户状态,以确保根据用户帐户状态进行操作.
//
检查用户登录用户名密码是否统一,帐户是否禁止等.
User userLookup
=
Users.FindUserByUsername(user.Username);
if
(userLookup
==
null
)
return
LoginUserStatus.InvalidCredentials;
//
检测帐号状态
if
(userLookup.IsBanned
&&
DateTime.Now
<=
userLookup.BannedUntil)
{
//
帐号禁止
return
LoginUserStatus.AccountBanned;
}
//
帐号封禁
else
if
(userLookup.IsBanned
&&
DateTime.Now
>
userLookup.BannedUntil)
{
//
Update to back to datastore
userLookup.AccountStatus
=
UserAccountStatus.Approved;
userLookup.BannedUntil
=
DateTime.Now;
Users.UpdateUser(userLookup);
}
//
待批准
if
(userLookup.AccountStatus
==
UserAccountStatus.ApprovalPending)
{
return
LoginUserStatus.AccountPending;
}
//
未批准
if
(userLookup.AccountStatus
==
UserAccountStatus.Disapproved)
{
return
LoginUserStatus.AccountDisapproved;
}
//
if (HttpContext.Current.User.Identity.AuthenticationType == "" )
//
如果不是来自WS请求
if
(
!
isRequestFromWebService)
{
//
获取用户Salt和密码加密格式,密码
user.Salt
=
userLookup.Salt;
user.PasswordFormat
=
userLookup.PasswordFormat;
//
Lucian: I think it must be reused. Usefull when there are a wide range of passwd formats.
//
Set the Password
user.Password
=
Users.Encrypt(user.PasswordFormat, user.Password, user.Salt);
}
//
通过数据库中验证用户.
return
(LoginUserStatus) dp.ValidateUser(user);
}
在ForumsHttpModule中，每次验证用户授权Application_AuthorizeRequest。