有時候會需要頁面會需要依照使用者權限的不同，可以進入的頁面也不同，在MVC裡面有預設Role與User的方式來篩選使用者，不過有時候權限分細一點時就沒辦法應付了，這個時候就需要自訂驗證了。

權限表單的結構資料如下：

1. 先在登入成功的地方放入一段程式，來把使用者有權限進入的頁面以字串的方式存入Session

   using (var db = new SqlConnection(ConfigurationManager.ConnectionStrings["DefaultConnection"].ConnectionString))
   
   {
   	String account = HttpContext.User.Identity.Name.ToString();
   	var list = db.Query<int>(@"
   SELECT 
   [a].[List_Id]
   FROM [dbo].[Permissions] AS [a]
   WHERE [a].[User_Id] = 
   (	SELECT [Id]
   FROm [dbo].[AspNetUsers] AS [z]
   WHERE [z].Email = @Email)", new { Email = model.Email }).ToList<int>();
   
   	Session["Permissions"] = string.Join(",", list.ToArray());
   }

    

2. 再來新建一個檔案名為CustomAuthorize.cs，程式碼如下：

   using System;
   using System.Collections.Generic;
   using System.Linq;
   using System.Web;
   using System.Web.Mvc;
   
   namespace WebApplication_CustomVerification.Verification
   {
       public class CustomAuthorize : AuthorizeAttribute
       {
           public int ListId { get; set; }
   
           protected override bool AuthorizeCore(HttpContextBase httpContext)
           {
               if (httpContext == null)
               {
                   throw new ArgumentNullException("httpContext");
               }
   
               //判斷是否已驗證
               if (httpContext.User.Identity.IsAuthenticated == false)
               {
                   return false;
               }
   
               bool boolIsRight = false;
   
               //Session過期，要求重新登入
               HttpSessionStateBase session = httpContext.Session;
               if (session.Count != 0 &&
                   session["Permissions"] != null &&
                   session["Permissions"].ToString() != "")
               {
                   List<string> list = session["Permissions"].ToString().Split(',').ToList();
                   foreach (var item in list)
                   {
                       if (item == ListId.ToString())
                       {
                           boolIsRight = true;
                           break;
                       }
                   }
               }
   
               return boolIsRight;
           }
       }
   }

   這邊覆寫了原本驗證的機制，改成判斷先前存入Session內的字串。

3. 這樣就可以在Action上面加上標籤來驗證使用者權限囉！

   using System.Web.Mvc;
   using WebApplication_CustomVerification.Verification;
   
   namespace WebApplication_CustomVerification.Controllers
   {
       public class HomeController : Controller
       {
   
           public ActionResult Index()
           {
               return View();
           }
   
           public ActionResult About()
           {
               ViewBag.Message = "Your application description page.";
   
               return View();
           }
   
           public ActionResult Contact()
           {
               ViewBag.Message = "Your contact page.";
   
               return View();
           }
   
           [CustomAuthorize(ListId = 1111)]
           public ActionResult List_01()
           {
   
               return View();
           }
   
           [CustomAuthorize(ListId = 1112)]
           public ActionResult List_02()
           {
   
               return View();
           }
   
           [CustomAuthorize(ListId = 1113)]
           public ActionResult List_03()
           {
   
               return View();
           }
       }
   }

範例程式：https://github.com/shuangrain/WebApplication_CustomVerification

參考：[C#][ASP.NET MVC]自訂AuthorizeAttribute

檔案上傳功能在網頁中常常出現，在ASP.NET MVC裡面要上傳檔案非常簡單，這裡簡單筆記一下有關 ASP.NET MVC 的檔案上傳基本操作方法。

• Controller

  [HttpPost]
  public ActionResult Upload(HttpPostedFileBase file)
  {
  	if (file != null && file.ContentLength > 0)
  	{
  		var fileName = Path.GetFileName(file.FileName);
  		var path = Server.MapPath("~/App_Data/FileUploads");
  		//若該資料夾不存在，則新增一個
  		if (!Directory.Exists(path))
  		{
  			Directory.CreateDirectory(path);
  		}
  		path = Path.Combine(path, fileName);
  		file.SaveAs(path);
  	}
  	return RedirectToAction("Upload");
  }

• View

  @using (Html.BeginForm("Upload", "Home", FormMethod.Post, new { enctype = "multipart/form-data" }))
  {
      <div class="form-horizontal">
          <div class="form-group">
              <label class="control-label col-sm-2">選擇檔案</label>
              <div class="col-sm-10">
                  <input type="file" name="file">
              </div>
          </div>
          <div class="form-group">
              <div class="col-sm-offset-2 col-sm-10">
                  <input type="submit" value="提交" class="btn btn-primary" />
              </div>
          </div>
      </div>
  }

  這邊要注意的是，如需要使用HttpPostedFileBase上傳檔案的話，則必須添加enctype = "multipart/form-data"，不然怎麼樣都沒辦法正常收到資料！
  另外如果使用下列語法是無法接收資料的，因這樣表單並沒有含enctype = "multipart/form-data"這項

  @using (Html.BeginForm("Upload", "Home", new { enctype = "multipart/form-data" }))

  一定要用改為下面的方法

  @using (Html.BeginForm("Upload", "Home", FormMethod.Post, new { enctype = "multipart/form-data" }))

範例程式：https://github.com/shuangrain/WebApplication_Upload