有時候會需要頁面會需要依照使用者權限的不同，可以進入的頁面也不同，在MVC裡面有預設Role與User的方式來篩選使用者，不過有時候權限分細一點時就沒辦法應付了，這個時候就需要自訂驗證了。

權限表單的結構資料如下：

1. 先在登入成功的地方放入一段程式，來把使用者有權限進入的頁面以字串的方式存入Session
   
   C#

   using (var db = new SqlConnection(ConfigurationManager.ConnectionStrings["DefaultConnection"].ConnectionString)) { String account = HttpContext.User.Identity.Name.ToString(); var list = db.Query<int>(@" SELECT [a].[List_Id] FROM [dbo].[Permissions] AS [a] WHERE [a].[User_Id] = ( SELECT [Id] FROm [dbo].[AspNetUsers] AS [z] WHERE [z].Email = @Email)", new { Email = model.Email }).ToList<int>(); Session["Permissions"] = string.Join(",", list.ToArray()); }

   1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

   using (var db = new SqlConnection(ConfigurationManager.ConnectionStrings["DefaultConnection"].ConnectionString))   { String account = HttpContext.User.Identity.Name.ToString(); var list = db.Query<int>(@" SELECT [a].[List_Id] FROM [dbo].[Permissions] AS [a] WHERE [a].[User_Id] = ( SELECT [Id] FROm [dbo].[AspNetUsers] AS [z] WHERE [z].Email = @Email)", new { Email = model.Email }).ToList<int>();   Session["Permissions"] = string.Join(",", list.ToArray()); }

   
    
2. 再來新建一個檔案名為CustomAuthorize.cs，程式碼如下：
   
   C#

   using System; using System.Collections.Generic; using System.Linq; using System.Web; using System.Web.Mvc; namespace WebApplication_CustomVerification.Verification { public class CustomAuthorize : AuthorizeAttribute { public int ListId { get; set; } protected override bool AuthorizeCore(HttpContextBase httpContext) { if (httpContext == null) { throw new ArgumentNullException("httpContext"); } //判斷是否已驗證 if (httpContext.User.Identity.IsAuthenticated == false) { return false; } bool boolIsRight = false; //Session過期，要求重新登入 HttpSessionStateBase session = httpContext.Session; if (session.Count != 0 && session["Permissions"] != null && session["Permissions"].ToString() != "") { List<string> list = session["Permissions"].ToString().Split(',').ToList(); foreach (var item in list) { if (item == ListId.ToString()) { boolIsRight = true; break; } } } return boolIsRight; } } }

   1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48

   using System; using System.Collections.Generic; using System.Linq; using System.Web; using System.Web.Mvc;   namespace WebApplication_CustomVerification.Verification {     public class CustomAuthorize : AuthorizeAttribute     {         public int ListId { get; set; }           protected override bool AuthorizeCore(HttpContextBase httpContext)         {             if (httpContext == null)             {                 throw new ArgumentNullException("httpContext");             }               //判斷是否已驗證             if (httpContext.User.Identity.IsAuthenticated == false)             {                 return false;             }               bool boolIsRight = false;               //Session過期，要求重新登入             HttpSessionStateBase session = httpContext.Session;             if (session.Count != 0 &&                 session["Permissions"] != null &&                 session["Permissions"].ToString() != "")             {                 List<string> list = session["Permissions"].ToString().Split(',').ToList();                 foreach (var item in list)                 {                     if (item == ListId.ToString())                     {                         boolIsRight = true;                         break;                     }                 }             }               return boolIsRight;         }     } }

   
   這邊覆寫了原本驗證的機制，改成判斷先前存入Session內的字串。
3. 這樣就可以在Action上面加上標籤來驗證使用者權限囉！
   
   C#

   using System.Web.Mvc; using WebApplication_CustomVerification.Verification; namespace WebApplication_CustomVerification.Controllers { public class HomeController : Controller { public ActionResult Index() { return View(); } public ActionResult About() { ViewBag.Message = "Your application description page."; return View(); } public ActionResult Contact() { ViewBag.Message = "Your contact page."; return View(); } [CustomAuthorize(ListId = 1111)] public ActionResult List_01() { return View(); } [CustomAuthorize(ListId = 1112)] public ActionResult List_02() { return View(); } [CustomAuthorize(ListId = 1113)] public ActionResult List_03() { return View(); } } }

   1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49

   using System.Web.Mvc; using WebApplication_CustomVerification.Verification;   namespace WebApplication_CustomVerification.Controllers {     public class HomeController : Controller     {           public ActionResult Index()         {             return View();         }           public ActionResult About()         {             ViewBag.Message = "Your application description page.";               return View();         }           public ActionResult Contact()         {             ViewBag.Message = "Your contact page.";               return View();         }           [CustomAuthorize(ListId = 1111)]         public ActionResult List_01()         {               return View();         }           [CustomAuthorize(ListId = 1112)]         public ActionResult List_02()         {               return View();         }           [CustomAuthorize(ListId = 1113)]         public ActionResult List_03()         {               return View();         }     } }

範例程式：https://github.com/shuangrain/WebApplication_CustomVerification

參考：[C#][ASP.NET MVC]自訂AuthorizeAttribute

檔案上傳功能在網頁中常常出現，在ASP.NET MVC裡面要上傳檔案非常簡單，這裡簡單筆記一下有關 ASP.NET MVC 的檔案上傳基本操作方法。

• Controller
  
  C#

  [HttpPost] public ActionResult Upload(HttpPostedFileBase file) { if (file != null && file.ContentLength > 0) { var fileName = Path.GetFileName(file.FileName); var path = Server.MapPath("~/App_Data/FileUploads"); //若該資料夾不存在，則新增一個 if (!Directory.Exists(path)) { Directory.CreateDirectory(path); } path = Path.Combine(path, fileName); file.SaveAs(path); } return RedirectToAction("Upload"); }

  1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

  [HttpPost] public ActionResult Upload(HttpPostedFileBase file) { if (file != null && file.ContentLength > 0) { var fileName = Path.GetFileName(file.FileName); var path = Server.MapPath("~/App_Data/FileUploads"); //若該資料夾不存在，則新增一個 if (!Directory.Exists(path)) { Directory.CreateDirectory(path); } path = Path.Combine(path, fileName); file.SaveAs(path); } return RedirectToAction("Upload"); }

• View
  
  C#

  @using (Html.BeginForm("Upload", "Home", FormMethod.Post, new { enctype = "multipart/form-data" })) { <div class="form-horizontal"> <div class="form-group"> <label class="control-label col-sm-2">選擇檔案</label> <div class="col-sm-10"> <input type="file" name="file"> </div> </div> <div class="form-group"> <div class="col-sm-offset-2 col-sm-10"> <input type="submit" value="提交" class="btn btn-primary" /> </div> </div> </div> }

  1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

  @using (Html.BeginForm("Upload", "Home", FormMethod.Post, new { enctype = "multipart/form-data" })) {     <div class="form-horizontal">         <div class="form-group">             <label class="control-label col-sm-2">選擇檔案</label>             <div class="col-sm-10">                 <input type="file" name="file">             </div>         </div>         <div class="form-group">             <div class="col-sm-offset-2 col-sm-10">                 <input type="submit" value="提交" class="btn btn-primary" />             </div>         </div>     </div> }

  
  這邊要注意的是，如需要使用HttpPostedFileBase上傳檔案的話，則必須添加enctype = "multipart/form-data"，不然怎麼樣都沒辦法正常收到資料！
  另外如果使用下列語法是無法接收資料的，因這樣表單並沒有含enctype = "multipart/form-data"這項
  
  C#

  @using (Html.BeginForm("Upload", "Home", new { enctype = "multipart/form-data" }))

  1	@using (Html.BeginForm("Upload", "Home", new { enctype = "multipart/form-data" }))

  
  一定要用改為下面的方法
  
  C#

  @using (Html.BeginForm("Upload", "Home", FormMethod.Post, new { enctype = "multipart/form-data" }))

  1	@using (Html.BeginForm("Upload", "Home", FormMethod.Post, new { enctype = "multipart/form-data" }))

範例程式：https://github.com/shuangrain/WebApplication_Upload

在ASP.NET MVC裡面，表單提交方法有兩種，一種是傳統的Html.BeginForm另外一種是利用JQuery實現的Ajax.BeginForm，平常我都是使用Html.BeginForm在處理表單，最近在寫上傳檔案功能的時候想玩Ajax.BeginForm看看，於是乎發生了Ajax無法正常運作的問題，拜了Google大神很久發現了原因是Visual Studio新建專案的時候沒有幫我加入Microsoft jQuery Unobtrusive Ajax這個套件，多虧這個原因讓我撞牆撞了好久，最後裝上去才解決問題。

解決步驟如下：

1. 對著專案點選右鍵選擇管理NuGet套件
   
2. 搜尋unobtrusive找到Microsoft.jQuery.Unobtrusive.Ajax選擇安裝
   
3. 在/App_Start/BundleConfig.cs裡面新增套件
   
   
   C#

   bundles.Add(new ScriptBundle("~/bundles/jqueryajax").Include( "~/Scripts/jquery.unobtrusive-ajax*"));

   1 2	bundles.Add(new ScriptBundle("~/bundles/jqueryajax").Include(             "~/Scripts/jquery.unobtrusive-ajax*"));

4. 在要使用的頁面加入以下語法使用
   
   C#

   @Scripts.Render("~/bundles/jqueryajax")

   1	@Scripts.Render("~/bundles/jqueryajax")