权限系统 02

# 关于在白名单里添加“/”没有加$的问题
# 匹配不上返回None
# 匹配上返回对象
import re
ret=re.match("/$","/orders/")
print(ret)  # None



ret1=re.match("/","/orders/")
print(ret1)  # <_sre.SRE_Match object; span=(0, 1), match='/'>

什么是权限：一个包含正则的url

关于某个角色拥有查看用户权限，但无添加用户权限

能匹配 /orders/ 但手动添加orders/add也能访问到

在中间件进行匹配url没有加$

粒度到按钮级别

没有权限的用户不显示按钮

views

def orders(request):
    permission_list=request.session.get("permission_list")    #["/orders/"]  订单页面在视图中能知道用户的权限   传到模板
    return render(request,"orders.html",locals())   


def orders_add(request):

    return HttpResponse("添加订单")

HTML

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <title>订单页面</title>
    <link rel="stylesheet" href="/static/bootstrap-3.3.7/css/bootstrap.css">
</head>
<body>

<h3>订单列表</h3>

<div class="col-md-6">
    {% if "/orders/add/" in permission_list %}
        <p><a href="/orders/add"><button class="btn btn-primary pull-right">添加订单</button></a></p>
    {% endif %}

<table class="table table-striped">
    <tr>
        <th>订单编号</th>
        <th>订单日期</th>
        <th>商品名称</th>
    </tr>
    <tr>
        <td>123456</td>
        <td>2016-12-16</td>
        <td>草莓</td>
    </tr>
</table>
</div>
</body>
</html>

但是上面有个局限性，就是不能进行正则判断

思路：给权限表进行分组，将权限之间的关系描述出来

from django.contrib import admin

# Register your models here.


from .models import *

admin.site.register(UserInfo)
admin.site.register(Role)
admin.site.register(PermissionGroup)



# 修改admin显示页面
class PermissionConfig(admin.ModelAdmin):
    list_display = ["id","title","url","permission_group"]
    ordering = ["id"]
admin.site.r

admin