|
|
@@ -4,8 +4,13 @@ import java.io.IOException;
|
|
|
import java.io.PrintWriter;
|
|
|
import java.security.MessageDigest;
|
|
|
import java.security.NoSuchAlgorithmException;
|
|
|
+import java.util.List;
|
|
|
+import java.util.regex.Matcher;
|
|
|
+import java.util.regex.Pattern;
|
|
|
+
|
|
|
import javax.servlet.ServletRequest;
|
|
|
import javax.servlet.ServletResponse;
|
|
|
+
|
|
|
import org.apache.shiro.SecurityUtils;
|
|
|
import org.apache.shiro.authc.AuthenticationException;
|
|
|
import org.apache.shiro.authc.AuthenticationToken;
|
|
|
@@ -14,6 +19,9 @@ import org.apache.shiro.authc.UnknownAccountException;
|
|
|
import org.apache.shiro.subject.Subject;
|
|
|
import org.apache.shiro.web.util.WebUtils;
|
|
|
import org.springframework.beans.factory.annotation.Autowired;
|
|
|
+
|
|
|
+import com.xt.gkoa.userManage.entity.UserLogtimeEntity;
|
|
|
+import com.xt.gkoa.userManage.service.UserLogtimeService;
|
|
|
import com.xtframe.core.org.entity.Org;
|
|
|
import com.xtframe.core.support.SecurityMgr;
|
|
|
import com.xtframe.core.user.entity.User;
|
|
|
@@ -21,79 +29,111 @@ import com.xtframe.core.utils.Assert;
|
|
|
import com.xtframe.core.utils.CoreConstants;
|
|
|
import com.xtframe.sec.common.CaptchaFormAuthenticationFilter;
|
|
|
|
|
|
-public class MyFilter extends CaptchaFormAuthenticationFilter{
|
|
|
+public class MyFilter extends CaptchaFormAuthenticationFilter {
|
|
|
|
|
|
@Autowired
|
|
|
private SecurityMgr securityMgr;
|
|
|
-
|
|
|
+ @Autowired
|
|
|
+ private UserLogtimeService userLogtimeservice;
|
|
|
public static final String ALGORITHM = "SHA-256";
|
|
|
-
|
|
|
|
|
|
+ @SuppressWarnings("unused")
|
|
|
@Override
|
|
|
protected boolean onLoginFailure(AuthenticationToken token, AuthenticationException e, ServletRequest request, ServletResponse response) {
|
|
|
- PrintWriter out = null;
|
|
|
- try {
|
|
|
- out = response.getWriter();
|
|
|
- UsernamePasswordCaptchaToken token1 = (UsernamePasswordCaptchaToken)token;
|
|
|
- User user = this.securityMgr.userService().findByUname(token1.getUsername());
|
|
|
- String captcha = token1.getCaptcha();
|
|
|
- String exitCode = (String) SecurityUtils.getSubject().getSession().getAttribute("yzm");
|
|
|
- if(e instanceof UnknownAccountException){
|
|
|
- out.write("unameerror");
|
|
|
- }else if(e instanceof IncorrectCredentialsException ){
|
|
|
- out.write("pwderror");
|
|
|
- }else{
|
|
|
- char[] ary = token1.getPassword();
|
|
|
- StringBuffer sb = new StringBuffer();
|
|
|
- for(int i = 0; i < ary.length; i++){
|
|
|
- sb.append(ary[i]);
|
|
|
- }
|
|
|
- String newPw = sb.toString();
|
|
|
- if(user==null){
|
|
|
+ PrintWriter out = null;
|
|
|
+ try {
|
|
|
+ out = response.getWriter();
|
|
|
+ UsernamePasswordCaptchaToken token1 = (UsernamePasswordCaptchaToken) token;
|
|
|
+ User user = this.securityMgr.userService().findByUname(token1.getUsername());
|
|
|
+
|
|
|
+ List<UserLogtimeEntity> list = userLogtimeservice.findByUserid(user.getId());
|
|
|
+ if (list != null && list.size() > 2) {
|
|
|
+ out.write("userlogtimeerror");
|
|
|
+ } else {
|
|
|
+ String captcha = token1.getCaptcha();
|
|
|
+ String exitCode = (String) SecurityUtils.getSubject().getSession().getAttribute("yzm");
|
|
|
+ if (e instanceof UnknownAccountException) {
|
|
|
out.write("unameerror");
|
|
|
- }else if(!(user.getPassword()).equals(SHA256Encrypt(newPw))){
|
|
|
+ } else if (e instanceof IncorrectCredentialsException) {
|
|
|
+ UserLogtimeEntity userTime = new UserLogtimeEntity();
|
|
|
+ userTime.setUserid(user.getId());
|
|
|
+ userTime.setUname(user.getUname());
|
|
|
+ userLogtimeservice.save(userTime);
|
|
|
out.write("pwderror");
|
|
|
- }else if(!captcha.equalsIgnoreCase(exitCode)){
|
|
|
- out.write("error");
|
|
|
- }else{
|
|
|
- out.write("unameerror");
|
|
|
+ } else {
|
|
|
+ char[] ary = token1.getPassword();
|
|
|
+ StringBuffer sb = new StringBuffer();
|
|
|
+ for (int i = 0; i < ary.length; i++) {
|
|
|
+ sb.append(ary[i]);
|
|
|
+ }
|
|
|
+ String newPw = sb.toString();
|
|
|
+ if (user == null) {
|
|
|
+ out.write("unameerror");
|
|
|
+ } else if (!(user.getPassword()).equals(SHA256Encrypt(newPw))) {
|
|
|
+ UserLogtimeEntity userTime = new UserLogtimeEntity();
|
|
|
+ userTime.setUserid(user.getId());
|
|
|
+ userTime.setUname(user.getUname());
|
|
|
+ userLogtimeservice.save(userTime);
|
|
|
+ out.write("pwderror");
|
|
|
+ } else if (!captcha.equalsIgnoreCase(exitCode)) {
|
|
|
+ out.write("error");
|
|
|
+ } else {
|
|
|
+ out.write("unameerror");
|
|
|
+ }
|
|
|
}
|
|
|
}
|
|
|
- }
|
|
|
- catch (IOException e2) {
|
|
|
- e2.printStackTrace();
|
|
|
- }finally{
|
|
|
- if(out!=null){
|
|
|
- out.flush();
|
|
|
- out.close();
|
|
|
- }
|
|
|
- }
|
|
|
- return false;
|
|
|
+
|
|
|
+ } catch (IOException e2) {
|
|
|
+ e2.printStackTrace();
|
|
|
+ } finally {
|
|
|
+ if (out != null) {
|
|
|
+ out.flush();
|
|
|
+ out.close();
|
|
|
+ }
|
|
|
+ }
|
|
|
+ return false;
|
|
|
}
|
|
|
|
|
|
@Override
|
|
|
protected boolean onLoginSuccess(AuthenticationToken token, Subject subject, ServletRequest request, ServletResponse response) throws Exception {
|
|
|
Object principal = subject.getPrincipal();
|
|
|
- GlobalData.isSSO=false;
|
|
|
- Assert.isInstanceOf(User.class, principal);
|
|
|
- User u = (User) principal;
|
|
|
- Assert.notNull(u.getOrg(), "用户所在组织不能为空！");
|
|
|
- Org org = securityMgr.orgService().findOne(u.getOrg());
|
|
|
- Assert.notNull(org, "用户所在组织不能为空！");
|
|
|
- subject.getSession().setAttribute(CoreConstants.SESSION_KEY_ORG, org);
|
|
|
- PrintWriter out = null;
|
|
|
- try {
|
|
|
- out = response.getWriter();
|
|
|
- out.write("success;"+u.getUname());
|
|
|
- }
|
|
|
- catch (IOException e) {
|
|
|
- e.printStackTrace();
|
|
|
- }finally{
|
|
|
- if(out!=null){
|
|
|
- out.flush();
|
|
|
- out.close();
|
|
|
- }
|
|
|
- }
|
|
|
+ GlobalData.isSSO = false;
|
|
|
+ Assert.isInstanceOf(User.class, principal);
|
|
|
+ User u = (User) principal;
|
|
|
+ Assert.notNull(u.getOrg(), "用户所在组织不能为空！");
|
|
|
+ Org org = securityMgr.orgService().findOne(u.getOrg());
|
|
|
+ Assert.notNull(org, "用户所在组织不能为空！");
|
|
|
+ subject.getSession().setAttribute(CoreConstants.SESSION_KEY_ORG, org);
|
|
|
+ String password = getPassword(request);
|
|
|
+ // 判断密码复杂性是否满足要求
|
|
|
+ Pattern p = Pattern.compile("^(?=.*?[a-zA-Z])(?=.*?\\d)(?=.*?[-`=\\\\\\[\\];',.\\/~!@#$%^&*()_+|{}:<>\"]).{8,}$");
|
|
|
+ Matcher m = p.matcher(password);
|
|
|
+ if (!m.find()) {
|
|
|
+ // 不符合要求
|
|
|
+ subject.getSession().setAttribute("pwdSecurity", "false");
|
|
|
+ }
|
|
|
+
|
|
|
+ PrintWriter out = null;
|
|
|
+ try {
|
|
|
+ out = response.getWriter();
|
|
|
+
|
|
|
+ // 登录成功删除登录失败信息
|
|
|
+ List<UserLogtimeEntity> list = userLogtimeservice.findByUid(u.getId());
|
|
|
+ if (list != null && list.size() > 0) {
|
|
|
+ for (UserLogtimeEntity userlog : list) {
|
|
|
+ userLogtimeservice.delete(userlog);
|
|
|
+ }
|
|
|
+ }
|
|
|
+ out.write("success;" + u.getUname());
|
|
|
+
|
|
|
+ } catch (IOException e) {
|
|
|
+ e.printStackTrace();
|
|
|
+ } finally {
|
|
|
+ if (out != null) {
|
|
|
+ out.flush();
|
|
|
+ out.close();
|
|
|
+ }
|
|
|
+ }
|
|
|
return false;
|
|
|
}
|
|
|
|
|
|
@@ -127,53 +167,51 @@ public class MyFilter extends CaptchaFormAuthenticationFilter{
|
|
|
|
|
|
String host = getHost(request);
|
|
|
|
|
|
- return new UsernamePasswordCaptchaToken(username,
|
|
|
- password.toCharArray(), rememberMe, host, captcha);
|
|
|
+ return new UsernamePasswordCaptchaToken(username, password.toCharArray(), rememberMe, host, captcha);
|
|
|
|
|
|
}
|
|
|
-
|
|
|
+
|
|
|
/**
|
|
|
* SHA-256加密
|
|
|
+ *
|
|
|
* @param orignal
|
|
|
* @return
|
|
|
*/
|
|
|
- public static String SHA256Encrypt(String orignal) {
|
|
|
- MessageDigest md = null;
|
|
|
- try {
|
|
|
- md = MessageDigest.getInstance(ALGORITHM);
|
|
|
- } catch (NoSuchAlgorithmException e) {
|
|
|
- e.printStackTrace();
|
|
|
- }
|
|
|
- if (null != md) {
|
|
|
- byte[] origBytes = orignal.getBytes();
|
|
|
- md.update(origBytes);
|
|
|
- byte[] digestRes = md.digest();
|
|
|
- String digestStr = getDigestStr(digestRes);
|
|
|
- return digestStr;
|
|
|
- }
|
|
|
-
|
|
|
- return null;
|
|
|
- }
|
|
|
-
|
|
|
- private static String getDigestStr(byte[] origBytes) {
|
|
|
- String tempStr = null;
|
|
|
- StringBuilder stb = new StringBuilder();
|
|
|
- for (int i = 0; i < origBytes.length; i++) {
|
|
|
- // System.out.println("and by bit: " + (origBytes[i] & 0xff));
|
|
|
- // System.out.println("no and: " + origBytes[i]);
|
|
|
- // System.out.println("---------------------------------------------");
|
|
|
- // 这里按位与是为了把字节转整时候取其正确的整数，java中一个int是4个字节
|
|
|
- // 如果origBytes[i]最高位为1，则转为int时，int的前三个字节都被1填充了
|
|
|
- tempStr = Integer.toHexString(origBytes[i] & 0xff);
|
|
|
- if (tempStr.length() == 1) {
|
|
|
- stb.append("0");
|
|
|
- }
|
|
|
- stb.append(tempStr);
|
|
|
-
|
|
|
- }
|
|
|
- return stb.toString();
|
|
|
- }
|
|
|
-
|
|
|
-
|
|
|
+ public static String SHA256Encrypt(String orignal) {
|
|
|
+ MessageDigest md = null;
|
|
|
+ try {
|
|
|
+ md = MessageDigest.getInstance(ALGORITHM);
|
|
|
+ } catch (NoSuchAlgorithmException e) {
|
|
|
+ e.printStackTrace();
|
|
|
+ }
|
|
|
+ if (null != md) {
|
|
|
+ byte[] origBytes = orignal.getBytes();
|
|
|
+ md.update(origBytes);
|
|
|
+ byte[] digestRes = md.digest();
|
|
|
+ String digestStr = getDigestStr(digestRes);
|
|
|
+ return digestStr;
|
|
|
+ }
|
|
|
+
|
|
|
+ return null;
|
|
|
+ }
|
|
|
+
|
|
|
+ private static String getDigestStr(byte[] origBytes) {
|
|
|
+ String tempStr = null;
|
|
|
+ StringBuilder stb = new StringBuilder();
|
|
|
+ for (int i = 0; i < origBytes.length; i++) {
|
|
|
+ // System.out.println("and by bit: " + (origBytes[i] & 0xff));
|
|
|
+ // System.out.println("no and: " + origBytes[i]);
|
|
|
+ // System.out.println("---------------------------------------------");
|
|
|
+ // 这里按位与是为了把字节转整时候取其正确的整数，java中一个int是4个字节
|
|
|
+ // 如果origBytes[i]最高位为1，则转为int时，int的前三个字节都被1填充了
|
|
|
+ tempStr = Integer.toHexString(origBytes[i] & 0xff);
|
|
|
+ if (tempStr.length() == 1) {
|
|
|
+ stb.append("0");
|
|
|
+ }
|
|
|
+ stb.append(tempStr);
|
|
|
+
|
|
|
+ }
|
|
|
+ return stb.toString();
|
|
|
+ }
|
|
|
|
|
|
}
|
ld_xuhx