如何限制用户条目只对Sepcific用户在EF 6 / ASP.NET MVC 5 [英] How To Restrict User Entries Only to that Sepcific User in EF 6/ASP.NET MVC 5

问题描述

我试图限制用户条目，以便只有特定的用户能看到自己的作品，而不是其他任何人。换句话说，毕竟我做了，我的应用程序仍然显示已进入过的每个条目;和任何用户能够看到的条目

I am trying to restrict user entries so that only that specific user is able to see their entries and not anyone else. In other words, after all I've done, my application still displays every entry that was ever entered; and any user is able to see the entries.

我使用code首先约定实体框架引用从我的费用表的外键我AspNetUsers的主键，但是，当我登录不同造就了一个一对多的关系用户，我仍然能看到条目（费用），其他用户输入。

I've created a one-to-many relationship by referencing the foreign key from my Expenses table to the primary key of my AspNetUsers using the Code First convention in Entity Framework, however, when I log in as different users, I am still able to see entries (expenses) that other users have entered.

我不知道问题是否出在我看来，模型或控制器。

I'm not sure whether the problem lies in my view, model, or controller.

下面是code我目前有：

Here is the code I currently have:

IdentityModel

 public class ApplicationUser : IdentityUser
{
    public ApplicationUser()
    {
        Expenses = new List<Expense>();
    }

    [Required]
    public string Fullname { get; set; }
    [Required]
    public string Province { get; set; }
    [Required]
    public string Company { get; set; }
    public virtual ICollection<Expense> Expenses { get; set; }

    public async Task<ClaimsIdentity> GenerateUserIdentityAsync(UserManager<ApplicationUser> manager)
    {
        // Note the authenticationType must match the one defined in CookieAuthenticationOptions.AuthenticationType
        var userIdentity = await manager.CreateIdentityAsync(this, DefaultAuthenticationTypes.ApplicationCookie);
        // Add custom user claims here
        return userIdentity;
    }


}

public class ApplicationDbContext : IdentityDbContext<ApplicationUser>
{
    public ApplicationDbContext()
        : base("PacificPetEntities", throwIfV1Schema: false)
    {
    }

    public IDbSet<Expense> Expenses { get; set; }

    public static ApplicationDbContext Create()
    {
        return new ApplicationDbContext();
    }



}

费用型号

public class Expense : IValidatableObject
{
    public Expense() { }

    [Key]
    [DatabaseGeneratedAttribute(DatabaseGeneratedOption.Identity)]
    public int ID { get; set; }
    [Required]
    public string Category { get; set; }
    public string Description { get; set; }

    [Required]
    [Display(Name = "Gross Amount")]
    public double GrossAmount { get; set; }
    [Required]
    [Display(Name = "Tax Amount")]
    public double TaxAmount { get; set; }
    [Required]
    [Display(Name = "Net Amount")]
    public double NetAmount { get; set; }
    public int Mileage { get; set; }
    [Display(Name = "Mileage Rate")]
    public double MileageRate { get; set; }

    [Required]
    [Display(Name = "Date Submitted")]
    public DateTime? DateSubmitted { get; set; }
    [Required]
    [Display(Name = "Expense Date")]
    public DateTime? ExpenseDate { get; set; }


    public string UserId { get; set; }
    [ForeignKey("UserId")]
    public virtual ApplicationUser ApplicationUser { get; set; }



    public IEnumerable<ValidationResult> Validate(ValidationContext validationContext)
    {
        if (Category == "Auto - Mileage" && Mileage == 0)
        {
            yield return new ValidationResult("You must enter a mileage amount if the chosen category is mileage.");
        }
    }

}

控制器

public class ExpensesController : Controller
{
    private ApplicationDbContext db = new ApplicationDbContext();

    // GET: Expenses
    [Authorize]
    public ActionResult Index()
    {
        var expenses = db.Expenses.Include(e => e.ApplicationUser);
        return View(expenses.ToList());
    }

    // GET: Expenses/Details/5
    [Authorize]
    public ActionResult Details(int? id)
    {
        if (id == null)
        {
            return new HttpStatusCodeResult(HttpStatusCode.BadRequest);
        }
        Expense expense = db.Expenses.Find(id);
        if (expense == null)
        {
            return HttpNotFound();
        }
        return View(expense);
    }

    // GET: Expenses/Create
    [Authorize]
    public ActionResult Create()
    {
        ViewBag.UserId = new SelectList(db.Users, "Id", "Fullname");
        return View();
    }

    // POST: Expenses/Create
    // To protect from overposting attacks, please enable the specific properties you want to bind to, for 
    // more details see http://go.microsoft.com/fwlink/?LinkId=317598.
    [HttpPost]
    [ValidateAntiForgeryToken]
    [Authorize]
    public ActionResult Create([Bind(Include = "ID,Category,Description,GrossAmount,TaxAmount,NetAmount,Mileage,MileageRate,DateSubmitted,ExpenseDate,UserId")] Expense expense)
    {
        if (ModelState.IsValid)
        {
            db.Expenses.Add(expense);
            db.SaveChanges();
            return RedirectToAction("Index");
        }

        ViewBag.UserId = new SelectList(db.Users, "Id", "Fullname", expense.UserId);
        return View(expense);
    }

    // GET: Expenses/Edit/5
    [Authorize]
    public ActionResult Edit(int? id)
    {
        if (id == null)
        {
            return new HttpStatusCodeResult(HttpStatusCode.BadRequest);
        }
        Expense expense = db.Expenses.Find(id);
        if (expense == null)
        {
            return HttpNotFound();
        }
        ViewBag.UserId = new SelectList(db.Users, "Id", "Fullname", expense.UserId);
        return View(expense);
    }

    // POST: Expenses/Edit/5
    // To protect from overposting attacks, please enable the specific properties you want to bind to, for 
    // more details see http://go.microsoft.com/fwlink/?LinkId=317598.
    [HttpPost]
    [ValidateAntiForgeryToken]
    [Authorize]
    public ActionResult Edit([Bind(Include = "ID,Category,Description,GrossAmount,TaxAmount,NetAmount,Mileage,MileageRate,DateSubmitted,ExpenseDate,UserId")] Expense expense)
    {
        if (ModelState.IsValid)
        {
            db.Entry(expense).State = System.Data.Entity.EntityState.Modified;
            db.SaveChanges();
            return RedirectToAction("Index");
        }
        ViewBag.UserId = new SelectList(db.Users, "Id", "Fullname", expense.UserId);
        return View(expense);
    }

    // GET: Expenses/Delete/5
    [Authorize]
    public ActionResult Delete(int? id)
    {
        if (id == null)
        {
            return new HttpStatusCodeResult(HttpStatusCode.BadRequest);
        }
        Expense expense = db.Expenses.Find(id);
        if (expense == null)
        {
            return HttpNotFound();
        }
        return View(expense);
    }

    // POST: Expenses/Delete/5
    [HttpPost, ActionName("Delete")]
    [ValidateAntiForgeryToken]
    [Authorize]
    public ActionResult DeleteConfirmed(int id)
    {
        Expense expense = db.Expenses.Find(id);
        db.Expenses.Remove(expense);
        db.SaveChanges();
        return RedirectToAction("Index");
    }

    protected override void Dispose(bool disposing)
    {
        if (disposing)
        {
            db.Dispose();
        }
        base.Dispose(disposing);
    }
}

Index.cshtml

 @model IEnumerable<PacificPetExpenses.Models.Expense>

@{
    ViewBag.Title = "Index";
    Layout = "~/Views/Shared/_Layout.cshtml";
}

<h2>Index</h2>

<p>
    @Html.ActionLink("Create New", "Create")
</p>
<table class="table">
    <tr>
        <th>
            @Html.DisplayNameFor(model => model.ApplicationUser.Fullname)
        </th>
        <th>
            @Html.DisplayNameFor(model => model.Category)
        </th>
        <th>
            @Html.DisplayNameFor(model => model.Description)
        </th>
        <th>
            @Html.DisplayNameFor(model => model.GrossAmount)
        </th>
        <th>
            @Html.DisplayNameFor(model => model.TaxAmount)
        </th>
        <th>
            @Html.DisplayNameFor(model => model.NetAmount)
        </th>
        <th>
            @Html.DisplayNameFor(model => model.Mileage)
        </th>
        <th>
            @Html.DisplayNameFor(model => model.MileageRate)
        </th>
        <th>
            @Html.DisplayNameFor(model => model.DateSubmitted)
        </th>
        <th>
            @Html.DisplayNameFor(model => model.ExpenseDate)
        </th>
        <th></th>
    </tr>

@foreach (var item in Model) {
    <tr>
        <td>
            @Html.DisplayFor(modelItem => item.ApplicationUser.Fullname)
        </td>
        <td>
            @Html.DisplayFor(modelItem => item.Category)
        </td>
        <td>
            @Html.DisplayFor(modelItem => item.Description)
        </td>
        <td>
            @Html.DisplayFor(modelItem => item.GrossAmount)
        </td>
        <td>
            @Html.DisplayFor(modelItem => item.TaxAmount)
        </td>
        <td>
            @Html.DisplayFor(modelItem => item.NetAmount)
        </td>
        <td>
            @Html.DisplayFor(modelItem => item.Mileage)
        </td>
        <td>
            @Html.DisplayFor(modelItem => item.MileageRate)
        </td>
        <td>
            @Html.DisplayFor(modelItem => item.DateSubmitted)
        </td>
        <td>
            @Html.DisplayFor(modelItem => item.ExpenseDate)
        </td>
        <td>
            @Html.ActionLink("Edit", "Edit", new { id=item.ID }) |
            @Html.ActionLink("Details", "Details", new { id=item.ID }) |
            @Html.ActionLink("Delete", "Delete", new { id=item.ID })
        </td>
    </tr>
}

</table>

请帮忙。

感谢您。

推荐答案

我已经找到了答案。 Padhraic真的很接近，但他的回答帮我解决我的问题。

I have found the answer. Padhraic was really close, but his answer helped me solve my problem.

在我的控制器，我有：

public ActionResult Index()
{
    var expenses = db.Expenses.Include(e => e.ApplicationUser);
    return View(expenses.ToList());
}

相反，这应该是：

Instead, this should be:

public ActionResult Index()
{
    string currentUserId = User.Identity.GetUserId();
    var expenses = db.Expenses.Where(e => e.UserId == currentUserId);
    return View(expenses.ToList());
}

据对我的问题斯蒂芬Muecke的评论， db.Expenses.Include（E => e.ApplicationUser）返航在我的数据库中的所有行。相反，我需要的结果进行过滤，以当前用户。

According to Stephen Muecke's comment on my question, db.Expenses.Include(e => e.ApplicationUser) was returning all rows in my database. Instead I needed to filter the results to the current user.

这篇关于如何限制用户条目只对Sepcific用户在EF 6 / ASP.NET MVC 5的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！