import com.opensymphony.xwork2.ActionContext;
import com.opensymphony.xwork2.ActionInvocation;
import com.opensymphony.xwork2.interceptor.AbstractInterceptor;
import com.shizongger.oa.domain.User;

public class CheckPrivilegeInterceptor extends AbstractInterceptor {

  @Override
  public String intercept(ActionInvocation invocation) throws Exception {
    System.out.println("---攔截器未攔截之前---");
    String result = invocation.invoke();
    System.out.println("---攔截器攔截之后---");
    return result;
  }
}

<!-- 配置攔截器 -->
    <interceptors>
      <!-- 聲明攔截器 -->
      <interceptor name="checkPrivilege" class="com.shizongger.oa.util.CheckPrivilegeInterceptor"></interceptor>
      
      <!-- 重新定義默認(rèn)的攔截器棧 -->
      <interceptor-stack name="defaultStack">
        <interceptor-ref name="checkPrivilege"></interceptor-ref>      
        <interceptor-ref name="defaultStack"></interceptor-ref>       
      </interceptor-stack>
    </interceptors>

public class MyServletContextListener implements ServletContextListener {
  
  Log log = LogFactory.getLog(this.getClass());
  
  @Autowired
  private PrivilegeService privilegeService;
  
  @Override
  public void contextDestroyed(ServletContextEvent sce) {
    log.debug("---銷毀監(jiān)聽器---");
  }

  @Override
  public void contextInitialized(ServletContextEvent sce) {
    ServletContext sc = sce.getServletContext();
    ApplicationContext ac = WebApplicationContextUtils.getWebApplicationContext(sc);
    PrivilegeService privilegeService = (PrivilegeService) ac.getBean("privilegeServiceImpl");
    List<Privilege> topPrivilegeList = privilegeService.findTopList();
    //將權(quán)限list放到比application作用域還大的ServletContext
    sc.setAttribute("topPrivilegeList", topPrivilegeList);
    
    // 準(zhǔn)備數(shù)據(jù)：allPrivilegeUrls
    Collection<String> allPrivilegeUrls = privilegeService.getAllPrivilegeUrls();
    sc.setAttribute("allPrivilegeUrls", allPrivilegeUrls);   
  }
}

  public String intercept(ActionInvocation invocation) throws Exception {   
    //獲取信息，從session中取出當(dāng)前登錄用戶
    User user = (User) ActionContext.getContext().getSession().get("user");
    String nameSpace = invocation.getProxy().getNamespace();
    String actionName = invocation.getProxy().getActionName();
    //對(duì)應(yīng)的權(quán)限地址
    String privilegeUrl = nameSpace + actionName;
    
    //如果未登錄
    if(user == null) {
      //如果是去登錄的頁面和登錄請(qǐng)求，就放行
      if("/user_login".equals(privilegeUrl)) {
        return invocation.invoke();
      //否則跳轉(zhuǎn)到登錄頁面
      } else {
        return "loginUI";
      }
    } else {
      //如果已經(jīng)登錄則判斷是否有權(quán)限
      if(user.hasPrivilegeByUrl(privilegeUrl)) {
        return invocation.invoke();
      } else {
        return "noPrivilegeError";
      }
    }
  }

/**
 * 用戶實(shí)體
 * @author shizongger
 * @date 2017/03/24
 */
public class User {
  private Log log = LogFactory.getLog(this.getClass());
  
  private Long id;
  
  private String loginName;
  
  private String password;
  
  private String name;
  
  private String gender;
  
  private String phoneNumber;
  
  private String email;
  
  private String description;
  
  private Department department;
  
  private Set<Role> roles;
  
  //getter/settter方法
  
  /**
   * 判斷用戶是否用該權(quán)限
   * @param privilegename 權(quán)限名稱
   * @return
   */
  public boolean hasPrivilegeByName(String privilegeName) {
    log.debug("權(quán)限名稱:" + privilegeName);
    
    //從本用戶中取出所有角色
    for(Role role : roles) {
      //從角色遍歷出所有權(quán)限
      Set<Privilege> privilegeList = role.getPrivileges();
      for(Privilege privilege : privilegeList) {
        if(privilegeName.equals(privilege.getName())) {
          log.debug(privilegeName + "---有權(quán)限---");
          return true;
        }
      }
    }
    
    log.debug(privilegeName + "---沒有權(quán)限---");
    return false;
  }
  
  /**
   * 判斷本用戶是否有指定URL的權(quán)限
   * 
   * @param privUrl
   * @return
   */
  public boolean hasPrivilegeByUrl(String privUrl) {
    // 超級(jí)管理有所有的權(quán)限
    if (isAdmin()) {
      return true;
    }

    // >> 去掉后面的參數(shù)
    int pos = privUrl.indexOf("?");
    if (pos > -1) {
      privUrl = privUrl.substring(0, pos);
    }
    // >> 去掉UI后綴
    if (privUrl.endsWith("UI")) {
      privUrl = privUrl.substring(0, privUrl.length() - 2);
    }

    // 如果本URL不需要控制，則登錄用戶就可以使用
    Collection<String> allPrivilegeUrls = (Collection<String>) ActionContext.getContext().getApplication().get("allPrivilegeUrls");
    if (!allPrivilegeUrls.contains(privUrl)) {
      return true;
    } else {
      // 普通用戶要判斷是否含有這個(gè)權(quán)限
      for (Role role : roles) {
        for (Privilege priv : role.getPrivileges()) {
          if (privUrl.equals(priv.getUrl())) {
            return true;
          }
        }
      }
      return false;
    }
  }

  /**
   * 判斷本用戶是否是超級(jí)管理員
   * 
   * @return
   */ 
  public boolean isAdmin() {
    return "admin".equals(loginName);
  }
}

@Service
public class PrivilegeServiceImpl extends DaoSupportImpl<Privilege> implements PrivilegeService {

  @Override
  @Transactional
  public List<Privilege> findTopList() {
    List<Privilege> topPrivletList = this.getSession()
    .createQuery("FROM Privilege p WHERE p.parent IS NULL")
    .list();
    
    return topPrivletList;
  }

  @Override
  @Transactional
  public Collection<String> getAllPrivilegeUrls() {
    return getSession().createQuery(//
        "SELECT DISTINCT p.url FROM Privilege p WHERE p.url IS NOT NULL")//
        .list();
  }

}