Authorization management method for shared file, server, client and storage medium

Abstract

The application discloses an authorization control method for shared files, a server, a client and a storage medium, and relates to the technical field of file sharing. The authorization control method comprises the following steps: receiving a connection request sent by a client through a second socket interface of the client through a first socket interface created in advance, and establishing a TCP connection with the client according to the connection request, wherein the connection request comprises an IP address of the server; receiving a control request sent by the client through the second socket interface through the first socket interface, and converting the control request into an authority control command; and performing a corresponding control operation on a corresponding shared file according to the authority control command. The technical scheme of the application guarantees the safety of the server and the stability of the sharing system, and improves the quality and efficiency of operation and maintenance.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer software operation and maintenance, and in particular to a shared file authorization control method, a server, a client and a storage medium. BACKGROUND

[0002] With the continuous development of enterprises, important information such as intangible assets and business secrets accumulated in the process of enterprise operation is usually stored in the form of electronic documents on the unit computer, which facilitates work, but also makes these files exist the risk of leakage and loss, therefore, an internal shared file server needs to be built to realize the interaction and control of files in work, but with the explosive growth of file quantity and user quantity, the problem of authorization distribution gradually emerges, for example, ordinary engineers cannot conveniently perform authorization and need to contact relevant system administrators to log in to the server for operation, and long-time login to the server is difficult to guarantee the security and stability of the shared system. SUMMARY

[0003] The technical problem to be solved by the present application is to provide a shared file authorization control method, a server, a client and a storage medium to solve the defect that the authorization distribution operation of the shared file permission in the prior art is complex.

[0004] The technical solution adopted by the present application to solve the technical problem is: a shared file authorization control method is constructed, applied to a server, the server stores shared files, and includes:

[0005] A first socket interface is pre-created to receive a connection request sent by a client through a second socket interface of the client, and a TCP connection with the client is established according to the connection request, wherein the connection request includes an IP address of the server;

[0006] A control request sent by a client through the second socket interface is received through the first socket interface, and the control request is converted into a permission control command;

[0007] According to the permission control command, a corresponding control operation is performed on the corresponding shared file.

[0008] Preferably, the control request includes an add / delete authorization request.

[0009] The step of converting the control request into a permission control command includes:

[0010] The add / delete authorization request is parsed to obtain first parsing information, the first parsing information includes: an add / delete instruction, path information of a shared file, a permission type, and at least one username to be added / deleted.

[0011] According to the adding / deleting instruction, a corresponding function function is determined, and the first analysis information is assembled by calling the underlying command of the server system to generate the permission adding / deleting command corresponding to each username.

[0012] Preferably, the management request includes an authorized user query request.

[0013] The step of converting the management request into a permission control command comprises:

[0014] The authorized user query request is parsed to obtain second analysis information, and the second analysis information includes a query instruction and path information of a shared file.

[0015] According to the query instruction, a corresponding function function is determined, and the second analysis information is assembled by calling the underlying command of the server system to generate the permission query command of the shared file.

[0016] Preferably, the management request includes a permission backup request.

[0017] The step of converting the management request into a permission control command comprises:

[0018] The permission backup request is parsed to obtain third analysis information, and the third analysis information includes a backup instruction and path information of a shared file.

[0019] According to the backup instruction, a corresponding function function is determined, and the third analysis information is assembled by calling the underlying command of the server system to generate the permission backup command.

[0020] Preferably, the management request includes an administrator permission acquisition request.

[0021] The step of converting the management request into a permission control command comprises:

[0022] The administrator permission acquisition request is parsed to obtain fourth analysis information, and the fourth analysis information includes a permission acquisition instruction and path information of a shared file.

[0023] The fourth analysis information is assembled by calling the underlying command of the server system to generate the permission acquisition command.

[0024] The application also constructs an authorized management method of a shared file, applied to a client, comprising:

[0025] sending a connection request to a first socket interface of a server through a second socket interface pre-created, so that the server establishes a TCP connection with the client according to the connection request, wherein the connection request comprises an IP address of the server;

[0026] receiving a control request input by a user and sending the control request to the first socket interface of the server through the second socket interface, so that the server converts the control request into an authority control command and performs a corresponding control operation on a corresponding shared file.

[0027] Preferably, the step of receiving the control request input by the user comprises:

[0028] According to the established GUI graphical operation interface, the control request input by the user on the GUI graphical operation interface is received.

[0029] The application also constructs a storage medium storing a computer program, which, when executed by a processor, implements the steps of the authorized control method of the shared file described above.

[0030] The application also constructs a server comprising a first processor, which, when executing a stored first computer program, implements the steps of the authorized control method of the shared file described above.

[0031] The application also constructs a client comprising a second processor, which, when executing a stored second computer program, implements the steps of the authorized control method of the shared file described above.

[0032] The technical solution of the application implements the TCP connection between the server and the client by establishing socket interfaces on the server and the client respectively, and also enables non-professionals to independently complete the authority control operation on their clients, thereby logically separating the authorized manager from the server device. In this way, since the relevant system administrator does not need to log in to the server for operation, the security of the server and the stability of the shared system are ensured, and the quality and efficiency of the operation and maintenance work are improved. BRIEF DESCRIPTION OF DRAWINGS

[0033] The application will be further described below with reference to the accompanying drawings and embodiments, in which:

[0034] Figure 1 is a flowchart of the authorized control method of the shared file according to the first embodiment of the application;

[0035] Figure 2 is a flowchart of the authorized control method of the shared file according to the second embodiment of the application;

[0036] Figure 3 is the interface schematic diagram of the client of the present application;

[0037] Figure 4 is the logical structure diagram of the authorization control system of the shared file of the present application. DETAILED DESCRIPTION

[0038] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the protection scope of the present application.

[0039] When the user authorization control is performed on the shared file (folder) on the server (taking the Windows system as an example), since the existing mode needs a special person to log in the shared server to perform the manual authorization operation, the workload is huge, and frequent login of the server is easy to cause various accidents, affecting the stability of the server. In view of the technical problem, the present application uses Python and the system command API interface provided by Windows to develop a C / S architecture of the client and the server, so that the authorization control function of the shared file can be completed on the client (such as an office computer) without logging in the server, the daily work process is simplified, and a large amount of manpower and workload is saved.

[0040] Figure 1 is the flowchart of the authorization control method embodiment one of the shared file of the present application, the authorization control method of the embodiment is applied to a server, and the server stores a shared file (folder), and the authorization control method of the embodiment comprises the following steps:

[0041] In step S11, a first socket interface is created in advance to receive a connection request sent by a second socket interface of a client, and a TCP connection with the client is established according to the connection request, wherein the connection request comprises an IP address of the server;

[0042] In this step, the server and the client are both pre-created with socket modules, which are a set of encapsulated interfaces responsible for data transmission, interaction, request and call. Specifically, for the server, it does not locate the socket interface of a specific client, but is in a state of waiting for connection and real-time monitoring of network status; for the client, the IP address of the server to be connected can be configured in the socket interface, and the port number can also be included, and then the connection request is sent through the socket interface. When the server socket interface listens to the connection request of the client socket interface, it can respond to the connection request of the client, establish a new thread, and send a connection confirmation to the client, so that the TCP connection between the client and the server is established.

[0043] Step S12, receiving the management and control request sent by the client through the second socket interface through the first socket interface, and converting the management and control request into an authority control command.

[0044] In this step, the management and control request can include: adding / deleting authorization request, authorized user query request, authority backup request, administrator authority acquisition request, etc., to realize the whole process control of "application-query-backup-authorization (deletion)" of the windows shared file.

[0045] When the TCP connection between the server and the client is established, if the client receives the management and control request input by the user, the management and control request can be sent to the server. After receiving the management and control request, the server can call the Icacls command or takeown command of the Windows system bottom layer to combine the received request data according to the format of the Icacls command or takeown command, so as to generate an authority control command that can be recognized by the Windows system. Finally, it should be noted that the Icacls command is a Windows system bottom layer command, which can execute various permission controls, display or modify the Dacl of the specified file, and specify the Dacl of the file in the directory for storage. The main function is to call the command to realize the permission modification, backup, batch addition of a single user and folder; the takeown command is a Windows system bottom layer command, and the system administrator can realize the function of forcibly obtaining all permissions of the file and folder.

[0046] Step S13, according to the authority control command, performing corresponding management and control operation on the corresponding shared file.

[0047] In the technical scheme of the embodiment, the TCP connection between the server and the client is realized by establishing the socket interface on the server and the client respectively, and non-professionals can also independently complete the permission control operation on their clients, so that the logical separation of the authorized manager and the server device is realized. In this way, since the relevant system administrator does not need to log in to the server for operation, the security of the server and the stability of the sharing system are ensured, and the operation and maintenance quality and efficiency are improved.

[0048] Further, when the number of authorized users of the shared file is increasing, and when the shared files that need to be authorized are also increasing, the Windows built-in sharing authorization can only authorize the permissions of a single user, and cannot add or delete the authorization in batches, which is a huge workload, and manual authorization is easy to cause permission allocation omission, loss, error, etc., thereby causing operation and maintenance confusion. To solve the technical problem, in an optional embodiment, the management and control request in step S12 can include an add / delete authorization request, which is input by the user through the client and then sent to the socket interface of the server through the socket interface of the client. Specifically, the content input by the user through the client includes: an add / delete instruction, path information (path name) of the shared file, a permission type, and at least one username to be added / deleted, wherein the path information of the shared file is the path name of the shared file to be operated; the permission type includes: read-only copy, read-write participation, full control, and recursive inheritance (for example, selecting a tick means to enable recursion, otherwise it means not to enable recursion). Then, the add / delete instruction, path name, permission type, whether to recursively, and username are spliced in order, and separated by semicolons to form a management and control request, for example: "add permission; path name; read-only copy; recursive inheritance; ['user01', 'user02', 'user03']".

[0049] The step of converting the management and control request into a permission control command in step S12 includes:

[0050] The add / delete authorization request is parsed to obtain first parsing information, and the first parsing information includes: an add / delete instruction, path information of a shared file, a permission type, and at least one username to be added / deleted;

[0051] According to the add / delete instruction, a corresponding function function is determined, and the first parsing information is assembled by calling the underlying command of the server system to generate a permission add / delete command corresponding to each username.

[0052] In this embodiment, after the server receives the add / delete authorization request, the server selects the corresponding packaged function function according to the "add / delete instruction" ranked first in the data of the request, and processes the remaining data by the selected function function. The function function calls the Icacls command of the underlying system of the Windows system according to the program logic, combines the corresponding data received by the server according to the format of the Icacls command to generate the permission addition / deletion command, for example: "lcacls 'path information' / grant:r 'username':'read-only permission''recursive inheritance / T'". It should be understood that when batch adding or deleting authorization is performed, that is, the username in the add / delete authorization request is multiple, the program will call the command multiple times and execute the corresponding function function multiple times, thereby realizing the batch operation function and improving the operation and maintenance work quality and efficiency.

[0053] Further, after a large number of authorizations are performed, it is often necessary to regularly sort out the list of authorized users and delete users who have expired and left. At present, the Windows system does not have a default option to export user permissions, and can only be screened manually folder by folder, which is difficult to solve the problems of a large number of personnel, cross-authorization, a large number of assets, and complex existence of missing and missing of various permissions. To solve this technical problem, in an optional embodiment, the management request in step S12 can include an authorized user query request. The authorized user query request is input by the user through the client, and then sent to the socket interface of the server through the socket interface of the client. Specifically, the content input by the user through the client includes: a query instruction, and path information (path name) of a shared file, wherein the path information of the shared file is the path name of the shared file to be queried, and then the query instruction and the path name are spliced in order and separated by a semicolon to form a management request. For example: "query permission; path name".

[0054] The step of converting the management request into a permission control command in step S12 includes:

[0055] The authorized user query request is parsed to obtain second parsed information, and the second parsed information includes: a query instruction and path information of a shared file;

[0056] According to the query instruction, a corresponding function function is determined, and the second parsed information is assembled by calling the underlying command of the server system to generate a permission query command of the shared file.

[0057] In this embodiment, after the server receives the authorized user query request, the server selects the corresponding function function encapsulated according to the "query instruction" ranked first in the data of the request, and processes the remaining data by the selected function function. The function function calls the Icacls command in the underlying Windows system according to the program logic, combines the corresponding data received by the server according to the Icacls command format to generate a permission query command, thereby realizing one-key query function and improving the operation and maintenance work quality and efficiency.

[0058] Further, since the current Windows shared system permission backup can only be backed up by professional technical personnel using system commands, the technical requirements for the operator are high, therefore, in an optional embodiment, the management and control request in step S12 can include a permission backup request, which is input by the user through the client and then sent to the socket interface of the server through the socket interface of the client. Specifically, the content input by the user through the client includes a backup instruction and path information (path name) of a shared file, wherein the path information of the shared file is the path name of the shared file to be backed up, then the backup instruction and the path name are spliced in order and separated by a semicolon to form a management and control request, for example: "backup permission; path name".

[0059] The step of converting the management and control request into a permission control command in step S12 includes:

[0060] The permission backup request is parsed to obtain third parsed information, and the third parsed information includes a backup instruction and path information of a shared file.

[0061] According to the backup instruction, a corresponding function function is determined, and a permission backup command is generated by assembling the third parsed information through the underlying command of the server system.

[0062] In this embodiment, after the server receives the permission backup request, the server selects the corresponding function function encapsulated according to the "backup instruction" ranked first in the data of the request, and processes the remaining data by the selected function function. The function function calls the Icacls command in the underlying Windows system according to the program logic, combines the corresponding data received by the server according to the Icacls command format to generate a permission backup command, thereby realizing one-key backup function and improving the operation and maintenance work quality and efficiency.

[0063] Further, for the case of the administrator who mistakenly deletes the shared file, in an optional embodiment, the management request in step S12 can include: an administrator permission acquisition request, which is input by the user through the client and then sent to the socket interface of the server through the socket interface of the client. Specifically, the content input by the user through the client includes: a permission acquisition instruction and path information (path name) of the shared file, then the permission acquisition instruction and the path name are spliced in the order of "permission acquisition instruction, path name", and separated by a semicolon to form the administrator permission acquisition request.

[0064] The step of converting the management request into a permission control command in step S12 includes:

[0065] The administrator permission acquisition request is parsed to obtain fourth parsed information, and the fourth parsed information includes: a permission acquisition instruction and path information of the shared file.

[0066] The fourth parsed information is assembled by calling the underlying command of the server system to generate a permission acquisition command.

[0067] In this embodiment, after the server receives the administrator permission acquisition request, the "permission acquisition instruction" ranked first in the data of the request is selected to encapsulate the corresponding function function, and the remaining data is processed by the selected function function. The function function calls the takeown command of the underlying windows system according to the program logic, combines the corresponding data received by the server according to the takeown command format to generate a permission acquisition command, so as to realize the acquisition of all system permissions of the shared folder and the acquisition of the administrator permission.

[0068] The application also constructs a server including a first processor, which realizes the steps of the authorization management method of the shared file described above when executing the stored first computer program. Moreover, the first computer program can be packaged into an exe file using pyinstaller and used to run in the windows system environment of the server.

[0069] Figure 2 is a flowchart of the second embodiment of the authorization management method of the shared file of the application. The authorization management method of this embodiment is applied to the client, for example, the office computer of the user. The authorization management method of this embodiment includes the following steps:

[0070] In step S21, a connection request is sent to the first socket interface of the server through the second socket interface created in advance to make the server establish a TCP connection with the client according to the connection request, wherein the connection request includes the IP address of the server.

[0071] In this step, the client and the server are both pre-created with a socket module, which is a set of encapsulated interfaces responsible for data transmission, interaction, request, and call. Specifically, for the client, the IP address of the server to be connected can be configured in the socket interface, and the port number can also be included, and then the connection request is sent through the socket interface; for the server, it does not locate the specific socket interface of the client, but is in a state of waiting for connection and real-time monitoring of network status. When the server's socket interface listens to the connection request of the client's socket interface, it can respond to the client's connection request, establish a new thread, and send a connection confirmation to the client, so that the TCP connection between the client and the server is established.

[0072] Step S22, receiving the user input control request, and sending the control request to the first socket interface of the server through the second socket interface, so that the server converts the control request into an authority control command and performs a corresponding control operation on the corresponding shared file.

[0073] In this step, the control request can include: adding / deleting authorization request, authorized user query request, authority backup request, administrator authority acquisition request, etc., to realize the whole process control of "application-query-backup-authorization (deletion)" of the windows shared file.

[0074] In the technical solution of this embodiment, the TCP connection between the server and the client is realized by establishing socket interfaces on the server and the client respectively, and non-professionals can also independently complete the authority control operation on their client, and finally the separation of the authorized management person and the server device in logic is realized. In this way, since the related system administrator does not need to log in to the server for operation, the security of the server and the stability of the shared system are ensured, and the quality and efficiency of operation and maintenance work are improved.

[0075] Further, in an optional embodiment, the step of receiving the user input control request in step S22 includes:

[0076] According to the established GUI graphical operation interface, the control request input by the user on the GUI graphical operation interface is received.

[0077] In this embodiment, the GUI graphical interface of the client can be developed using python Tkinter technology (an interface of an open source standard GUI toolkit, which provides rich window components and can run on most system platforms), Socket technology, such as Figure 3As shown, the user can quickly configure the permissions on the client, for example, including: input path name (path information of the shared file to be operated); input username (multiple); input server (such as IP address); select permission type (read-only copy, read-write participation, full control, recursive inheritance); select operation instruction (add permissions, delete permissions, query authorization, empty input, backup permissions), in addition, in order to prevent misoperation, the "get administrator permission" button as a non-daily use button can be hidden at the bottom of the GUI interface, and needs to maximize the GUI interface to display.

[0078] Further, for some commonly used path names, records and storage can also be performed, so that the next time of use can directly call, thereby realizing quick selection of daily use of authorized path.

[0079] The application also constructs a client including a second processor, which realizes the steps of the authorization control method of the shared file described above when executing a stored second computer program. Moreover, the second computer program can be packaged into an exe file using pyinstaller and used for running in the system environment of the client.

[0080] Figure 4 It is a logical structure diagram of the authorization control system of the shared file of the application, and the authorization control system of the embodiment includes a server 10 and a client 20. The logical structure diagrams of the server 10 and the client 20 can refer to the description above, and will not be repeated here. Moreover, the two constitute a C / S architecture.

[0081] The application also constructs a storage medium, which stores a computer program, and the computer program realizes the steps of the authorization control method of the shared file described above when executed by a processor.

[0082] The storage medium of the application can be a U disk, a mobile hard disk, a read-only memory (ROM), a magnetic disk or an optical disk, and various computer readable storage media that can store program codes.

[0083] The above description is only the preferred embodiment of the application and is not used to limit the application. For those skilled in the art, the application can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the application shall be included in the scope of claims of the application.

Claims

1. A method for authorizing and controlling shared files, applied to a server, wherein the server stores shared files, characterized in that, include: The server receives connection requests sent by clients through their second socket interface via a pre-created first socket interface, and establishes a TCP connection with the client based on the connection request, wherein the connection request includes the server's IP address. The system receives management requests sent by clients through the second socket interface via the first socket interface and converts the management requests into access control commands. According to the permission control command, perform corresponding management and control operations on the corresponding shared files; The control requests include add / delete authorization requests; these add / delete authorization requests are entered by the user through their client. The step of converting the control request into an access control command includes: The add / delete authorization request is parsed to obtain first parsing information, which includes: add / delete instruction, shared file path information, permission type, and at least one username to be added / deleted; wherein, the shared file path information is the path name of the shared file to be operated on; the permission type includes: read-only copy, read-write participation, full control, and recursive inheritance; The corresponding function is determined based on the add / delete instruction, and the first parsed information is assembled by calling the underlying commands built into the server system. The assembly is performed in the order of "add / delete instruction, path name, permission type, whether recursive, username" to generate permission add / delete commands corresponding to each username. The control request also includes a permission backup request; The step of converting the control request into an access control command further includes: The permission backup request is parsed to obtain third parsing information, which includes: backup instructions and path information of shared files; The corresponding function is determined according to the backup instruction, and the third parsed information is assembled by calling the underlying commands built into the server system to generate the permission backup command.

2. The method for authorizing and controlling shared files according to claim 1, characterized in that, The control request includes an authorized user query request; The step of converting the control request into an access control command includes: The authorized user's query request is parsed to obtain second parsing information, which includes: query instructions and path information of shared files; The corresponding function is determined based on the query instruction, and the second parsed information is assembled by calling the underlying commands built into the server system to generate the permission query command for the shared file.

3. The method for authorizing and controlling shared files according to claim 1, characterized in that, The control request includes a request to obtain administrator privileges; The step of converting the control request into an access control command includes: The administrator permission acquisition request is parsed to obtain fourth parsing information, which includes: permission acquisition instruction and shared file path information; The fourth parsed information is assembled by calling the underlying commands built into the server system to generate a permission acquisition command.

4. A method for authorizing and controlling shared files, applied to a client, characterized in that, include: A connection request is sent to the server's first socket interface through a pre-created second socket interface, so that the server establishes a TCP connection with the client based on the connection request, wherein the connection request includes the server's IP address; The system receives a control request input by the user and sends the control request to the first socket interface of the server through the second socket interface, so that the server converts the control request into an access control command and performs corresponding control operations on the corresponding shared files. The control requests include add / delete authorization requests; these add / delete authorization requests are entered by the user through their client. The step of converting the control request into an access control command includes: The add / delete authorization request is parsed to obtain first parsing information, which includes: add / delete instruction, shared file path information, permission type, and at least one username to be added / deleted; wherein, the shared file path information is the path name of the shared file to be operated on; the permission type includes: read-only copy, read-write participation, full control, and recursive inheritance; The corresponding function is determined based on the add / delete instruction, and the first parsed information is assembled by calling the underlying commands built into the server system. The assembly is performed in the order of "add / delete instruction, path name, permission type, whether recursive, username" to generate permission add / delete commands corresponding to each username. The control request also includes a permission backup request; The step of converting the control request into an access control command further includes: The permission backup request is parsed to obtain third parsing information, which includes: backup instructions and path information of shared files; The corresponding function is determined according to the backup instruction, and the third parsed information is assembled by calling the underlying commands built into the server system to generate the permission backup command.

5. The method for authorizing and controlling shared files according to claim 4, characterized in that, The step of receiving the control request input by the user includes: Based on the established GUI (Graphical User Interface), the system receives control requests input by the user on the GUI.

6. A storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the shared file authorization management method according to any one of claims 1-5.

7. A server, comprising a first processor, characterized in that, The first processor implements the steps of the shared file authorization management method according to any one of claims 1-3 when executing the stored first computer program.

8. A client, comprising a second processor, characterized in that, The second processor implements the steps of the shared file authorization management method according to any one of claims 4-5 when executing the stored second computer program.

Images