asp.net Forums 之安全

在上一篇文章中，我们讨论了asp.net Forums 之HttpHandler和HttpModule，在这里放这个链接，是因为在本篇文件中需要用到上HttpModule相关的内容。

首先在Web.Config中配制为匿名用户不允许查看相关贴子。

<location path="EditPost.aspx">
  <system.web>
   <authorization>
    <deny users="?" />
   </authorization>
  </system.web>
 </location>
 <location path="PostAttachmentManager.aspx">
  <system.web>
   <authorization>
    <deny users="?" />
   </authorization>
  </system.web>
 </location>
 <location path="PrivateMessage.aspx">
  <system.web>
   <authorization>
    <deny users="?" />
   </authorization>
  </system.web>
 </location>
 <location path="Download.aspx">
  <system.web>
   <authorization>
    <deny users="?" />
   </authorization>
  </system.web>
 </location>
 <location path="License.aspx">
  <system.web>
   <authorization>
    <deny users="?" />
   </authorization>
  </system.web>
 </location>

用户登录时验证用户信息

// *********************************************************************
        //  LoginButton_Click
        //
        /// <summary>
        /// Event handler to handle the login button click event
        /// </summary>
        // ***********************************************************************/
        public void LoginButton_Click(Object sender, EventArgs e)
        {
            User userToLogin = new User();
            // 增加返回url by venjiang
            string redirectUrl = forumContext.ReturnUrl;

            if (!Page.IsValid)
                return;

            // [FRUM-183]增加验证码 by venjiang 2005/10/10
            if(Globals.GetSiteSettings().EnableAntiSpamTextGenerate
                && Globals.GetSiteSettings().EnableAntiSpamTextGenerateForLogin)
            {
                if(antiSpamText.Text != Globals.GetForumsAntiSpamText())
                    throw new ForumException(ForumExceptionType.AntiSpamTextNotMatch);
            }

            userToLogin.Username = username.Text;
            userToLogin.Password = password.Text;
            userToLogin.IPLastLogin = Globals.IPAddress;
            // 用户代理信息增加 by venjiang 2005/01/21
            userToLogin.IPLocation = IPScanner.IPLocation(Globals.IPAddress);
            userToLogin.Platform = Users.GetUsersInfo(forumContext.Context.Request.UserAgent, 1);
            userToLogin.Browser = Users.GetUsersInfo(forumContext.Context.Request.UserAgent, 2);

            LoginUserStatus loginStatus = Users.ValidUser(userToLogin);

            if (loginStatus == LoginUserStatus.Success)
            {
                // 如果系统设置不允许登录
                if (!Globals.GetSiteSettings().AllowLogin)
                {
                    bool allowed = false;

                    int userid = Users.FindUserByUsername(userToLogin.Username).UserID;
                    ArrayList roles = Roles.GetRoles(userid);
                    // 如果是管理员,则设置允许登录
                    foreach (Role role in roles)
                    {
                        if (role.Name == "Site Administrators" || role.Name == "Global Administrators")
                        {
                            allowed = true;
                            break;
                        }
                    }

                    // 处理用户登录处理
                    if (!allowed)
                    {
                        throw new ForumException(ForumExceptionType.UserLoginDisabled);
                    }
                }

//               FormsAuthentication.SetAuthCookie(userToLogin.Username, autoLogin.Checked);罗田040823


                // 根据cookies下拉列表选择项的值设置cookie
                SetLoginCookie(userToLogin.Username, autoLogin.SelectedValue);


                // 设置返回url
                if (redirectUrl != null && redirectUrl.Length > 0)
                {
                    // 增加返回url判断 by venjiang 2005/01/20
                    // redirectUrl = (redirectUrl.IndexOf("MessageID") == -1 ? redirectUrl : Globals.GetSiteUrls().Home);
                    // 修订 by venjiang 2005/03/28
                    if ((redirectUrl.IndexOf("MessageID") != -1)
                        || (redirectUrl.IndexOf(Globals.GetSiteUrls().Logout) != -1)
                        || (redirectUrl.IndexOf("ChangePassword") != -1)
                        || (redirectUrl.IndexOf("EmailForgottenPassword") != -1))
                        Page.Response.Redirect(Globals.GetSiteUrls().Home, true);
                    else
                        Page.Response.Redirect(redirectUrl, true);
                }
                else
                {
                    //Page.Response.Redirect(Globals.ApplicationPath, true);
                    // 修订 by venjiang 2005/01/20
                    Page.Response.Redirect(Globals.GetSiteUrls().Home, true);
                }

            }
            else if (loginStatus == LoginUserStatus.InvalidCredentials)
            { // Invalid Credentials
                throw new ForumException(ForumExceptionType.UserInvalidCredentials, "UserName:" + userToLogin.Username);
            }
            else if (loginStatus == LoginUserStatus.AccountPending)
            { // Account not approved yet
                throw new ForumException(ForumExceptionType.UserAccountPending);
            }
            else if (loginStatus == LoginUserStatus.AccountBanned)
            { // Account banned
                throw new ForumException(ForumExceptionType.UserAccountBanned, userToLogin.Nickname + "(" + userToLogin.Username + ")");
            }
            else if (loginStatus == LoginUserStatus.AccountDisapproved)
            { // Account disapproved
                throw new ForumException(ForumExceptionType.UserAccountDisapproved, userToLogin.Nickname + "(" + userToLogin.Username + ")");
            }
            else if (loginStatus == LoginUserStatus.UnknownError)
            { // Unknown error because of miss-syncronization of internal data
                throw new ForumException(ForumExceptionType.UserUnknownLoginError);
            }
        }

public static bool AuthenticateUser(User userToLogin)
        {
            LoginUserStatus loginStatus = Users.ValidUser(userToLogin);

            if (loginStatus == LoginUserStatus.Success)
            {
                // Are we allowing login?
                // TODO -- this could be better optimized
                if (!Globals.GetSiteSettings().AllowLogin)
                {
                    bool allowed = false;

                    int userid = Users.FindUserByUsername(userToLogin.Username).UserID;
                    ArrayList roles = Roles.GetRoles(userid);

                    foreach (Role role in roles)
                    {
                        if (role.Name == "Site Administrators" || role.Name == "Global Administrators")
                        {
                            allowed = true;
                            break;
                        }
                    }

                    // Check the user is in the administrator role
                    if (!allowed)
                    {
                        throw new ForumException(ForumExceptionType.UserLoginDisabled);
                    }
                }
                return true;
            }
            else
            {
                if (loginStatus == LoginUserStatus.InvalidCredentials)
                { // Invalid Credentials
                    throw new ForumException(ForumExceptionType.UserInvalidCredentials, userToLogin.Username);
                }
                else if (loginStatus == LoginUserStatus.AccountPending)
                { // Account not approved yet
                    throw new ForumException(ForumExceptionType.UserAccountPending);
                }
                else if (loginStatus == LoginUserStatus.AccountBanned)
                { // Account banned
                    throw new ForumException(ForumExceptionType.UserAccountBanned, userToLogin.Username);
                }
                else if (loginStatus == LoginUserStatus.AccountDisapproved)
                { // Account disapproved
                    throw new ForumException(ForumExceptionType.UserAccountDisapproved, userToLogin.Username);
                }
                else if (loginStatus == LoginUserStatus.UnknownError)
                { // Unknown error because of miss-syncronization of internal data
                    throw new ForumException(ForumExceptionType.UserUnknownLoginError);
                }
                return false;
            }
        }

//    用户验证
        /// <summary>
        /// 验证用户有效性
        /// </summary>
        /// <param name="user">
        /// 要验证的用户,用户名和密码属性是必须的.
        /// </param>
        /// <returns>返回当前用户登录状态</returns>
        public static LoginUserStatus ValidUser(User user)
        {
            return ValidUser(user, false);
        }

        /// <summary>
        /// 验证用户登录状态
        /// </summary>
        /// <param name="user">要验证的用户</param>
        /// <param name="isRequestFromWebService">是否来自Web服务请求</param>
        /// <returns>返回用户登录状态</returns>
        // 登录验证-1
        public static LoginUserStatus ValidUser(User user, bool isRequestFromWebService)
        {
            ForumsDataProvider dp = ForumsDataProvider.Instance();

            // Lookup account by provided username
            // 查找用户状态,以确保根据用户帐户状态进行操作.
            // 检查用户登录用户名密码是否统一,帐户是否禁止等.
            User userLookup = Users.FindUserByUsername(user.Username);
            if (userLookup == null)
                return LoginUserStatus.InvalidCredentials;

            // 检测帐号状态
            if (userLookup.IsBanned && DateTime.Now <= userLookup.BannedUntil)
            {
                // 帐号禁止
                return LoginUserStatus.AccountBanned;
            }
                // 帐号封禁
            else if (userLookup.IsBanned && DateTime.Now > userLookup.BannedUntil)
            {
                // Update to back to datastore
                userLookup.AccountStatus = UserAccountStatus.Approved;
                userLookup.BannedUntil = DateTime.Now;

                Users.UpdateUser(userLookup);
            }
            // 待批准
            if (userLookup.AccountStatus == UserAccountStatus.ApprovalPending)
            {
                return LoginUserStatus.AccountPending;
            }
            // 未批准
            if (userLookup.AccountStatus == UserAccountStatus.Disapproved)
            {
                return LoginUserStatus.AccountDisapproved;
            }

//            if (HttpContext.Current.User.Identity.AuthenticationType == "" ) 
            // 如果不是来自WS请求
            if (!isRequestFromWebService)
            {
                // 获取用户Salt和密码加密格式,密码
                user.Salt = userLookup.Salt;
                user.PasswordFormat = userLookup.PasswordFormat; // Lucian: I think it must be reused. Usefull when there are a wide range of passwd formats.
                // Set the Password
                user.Password = Users.Encrypt(user.PasswordFormat, user.Password, user.Salt);
            }
            // 通过数据库中验证用户.
            return (LoginUserStatus) dp.ValidateUser(user);
        }

在ForumsHttpModule中，每次验证用户授权Application_AuthorizeRequest。