MVC 部分限制非管理员用户的视图访问

Question

是否可以根据访问限制来限制对视图某些部分的访问？目前我可以通过在控制器中执行此操作来限制用户访问页面

[RestrictAccess(restriction = AccessRestrictions.Admin)]

但我是否可以限制页面的某个方面，同时仍允许其他用户访问该页面？

这是检查用户是否具有访问权限的模型

 public enum AccessRestrictions
    {      
        [Display(Name = "Admin")]
        Admin
    }
    public class userAccess
    {
        [Key]
        public int ID { get; set; }
        public AccessRestrictions restriction { get; set; }
        public bool allow { get; set; }
        public int userID { get; set; }

    }
    public class configDetails
    {
        public int ID {get; set;}
        public string Name {get; set;}
        public string Value {get;set;}
        public bool deleted {get;set;}
        public DateTime updateTime { get; set; }

    }
    public class Config
    {
        public int ID { get; set; }

        [Display(Name = "Configuration Date")]
        public DateTime TargetDate { get; set; }

           [Display(Name = "Enable Access Restrictions")]
        public bool restrictAccess { get; set; }

     }     

Answer 1

假设你有关注视图

<div id="CallList">
  @Html.Action("List","Call",new {id=Model.id})
</div>

<div class="Order">
  @Html.Action("Create","Order",new {id=Model.id})
</div>

跟随动作：

[Authorize(Roles = "manager, caller")] //if a user is not 'manager' or 'caller'
public PartialViewResult List()        // nothing is shown
{
  //...private 
  return PartialView();
}

[Authorize(Roles = "manager, admin")]
public PartialViewResult Create()
{
  //...private 
  return PartialView();
}

然后您可以通过此分机限制访问。方法

public static  MvcHtmlString ActionBaseRole(this HtmlHelper value, string actionName, string controllerName, object routeValues , IPrincipal user)
 {     
   bool userHasRequeredRole = false;
   Type t = Type.GetType((string.Format("MyProject.Controllers.{0}Controller",controllerName))); // MyProject.Controllers... replace on you namespace
   MethodInfo method = t.GetMethod(actionName);
   var attr = (method.GetCustomAttribute(typeof(AuthorizeAttribute), true) as AuthorizeAttribute);
   if (attr != null)
   {
      string[] methodRequeredRoles = attr.Roles.Split(',');
      userHasRequeredRole = methodRequeredRoles.Any(r => user.IsInRole(r.Trim())); // user roles check in depends on implementation authorization in you site  
                                                                                            // In a simple version that might look like                                                                         
   }
   else userHasRequeredRole = true; //method don't have Authorize Attribute
   return userHasRequeredRole ? value.Action(actionName, controllerName, routeValues) : MvcHtmlString.Empty; 
 }

使用示例：

@Html.ActionBaseRole("List","Call",new {id=Model.id},User)

请注意，您的安全属性不同，但我认为您可以轻松替换它。