From a14ba472eb65c195c358fb793c1e7aff2378dc45 Mon Sep 17 00:00:00 2001 From: dinggang <2498628697@qq.com> Date: Mon, 14 Nov 2022 16:29:00 +0800 Subject: [PATCH 1/2] =?UTF-8?q?1.=E7=AC=AC=E4=B8=89=E6=96=B9=E6=A3=80?= =?UTF-8?q?=E6=B5=8B=E9=97=AE=E9=A2=98=E4=BF=AE=E5=A4=8D-=E7=99=BB?= =?UTF-8?q?=E5=BD=95=E6=97=B6=E7=94=A8=E6=88=B7=E4=BF=A1=E6=81=AF=E6=98=8E?= =?UTF-8?q?=E6=96=87=E4=BC=A0=E8=BE=93=202.=E7=AC=AC=E4=B8=89=E6=96=B9?= =?UTF-8?q?=E6=A3=80=E6=B5=8B=E9=97=AE=E9=A2=98=E4=BF=AE=E5=A4=8D-?= =?UTF-8?q?=E6=9C=AA=E5=AF=B9=E7=94=A8=E6=88=B7=E7=99=BB=E5=BD=95=E6=AC=A1?= =?UTF-8?q?=E6=95=B0=E8=BF=9B=E8=A1=8C=E9=99=90=E5=88=B6?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../domain/TsingtaoDataResourceService.java | 1 - .../security/controller/LoginController.java | 92 ++++++++++++++----- .../modules/sys/entity/SysUserEntity.java | 5 + 3 files changed, 75 insertions(+), 23 deletions(-) diff --git a/renren-admin/src/main/java/io/renren/modules/resource/dataResource/domain/TsingtaoDataResourceService.java b/renren-admin/src/main/java/io/renren/modules/resource/dataResource/domain/TsingtaoDataResourceService.java index 3293ee83..74ebaa7a 100644 --- a/renren-admin/src/main/java/io/renren/modules/resource/dataResource/domain/TsingtaoDataResourceService.java +++ b/renren-admin/src/main/java/io/renren/modules/resource/dataResource/domain/TsingtaoDataResourceService.java @@ -31,7 +31,6 @@ public class TsingtaoDataResourceService extends AbstractDataResourceService { TsingtaoDataResourceService.restTemplate = SpringContextUtils.getBean(RestTemplate.class); } - @Override public Object getDataResource(GetDataResourceListDto dto) { diff --git a/renren-admin/src/main/java/io/renren/modules/security/controller/LoginController.java b/renren-admin/src/main/java/io/renren/modules/security/controller/LoginController.java index e9f7c48b..50d10ad0 100644 --- a/renren-admin/src/main/java/io/renren/modules/security/controller/LoginController.java +++ b/renren-admin/src/main/java/io/renren/modules/security/controller/LoginController.java @@ -1,12 +1,16 @@ package io.renren.modules.security.controller; +import cn.hutool.core.date.DateUtil; +import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper; import io.renren.common.annotation.LogOperation; import io.renren.common.constant.Constant; import io.renren.common.exception.ErrorCode; import io.renren.common.exception.RenException; +import io.renren.common.utils.DateUtils; import io.renren.common.utils.IpUtils; import io.renren.common.utils.Result; import io.renren.common.validator.AssertUtils; +import io.renren.modules.log.dao.SysLogLoginDao; import io.renren.modules.log.entity.SysLogLoginEntity; import io.renren.modules.log.enums.LoginOperationEnum; import io.renren.modules.log.enums.LoginStatusEnum; @@ -65,6 +69,8 @@ public class LoginController { private CaptchaService captchaService; @Autowired private SysLogLoginService sysLogLoginService; + @Autowired + private SysLogLoginDao logLoginDao; @Autowired(required = false) private SSOValidator ssoValidator; @@ -72,6 +78,11 @@ public class LoginController { @Value("${yawei.enable}") private Boolean yaweiEnable; // 亚微登录？ + @Value("${system.maxErrorTimes}") + private Integer maxErrorTimes; + @Value("${system.resumeLogonTime}") + private Integer resumeLogonTime; + @GetMapping("captcha") @ApiOperation(value = "验证码", produces = "application/octet-stream") @ApiImplicitParam(paramType = "query", dataType = "string", name = "uuid", required = true) @@ -95,21 +106,25 @@ public class LoginController { public Result login(HttpServletRequest request, HttpServletResponse response, @ApiIgnore @RequestParam Map params) throws Exception { LoginDTO login = new LoginDTO(); - login.setUsername(String.valueOf(params.get("username"))); + + //2022-11-11 修改用户名加密传输 + String userName = PasswordUtils.desEncrypt(String.valueOf(params.get("username"))); + login.setUsername(userName); + //login.setUsername(String.valueOf(params.get("username"))); String password = PasswordUtils.desEncrypt(String.valueOf(params.get("password"))); login.setPassword(password); login.setUuid(String.valueOf(params.get("uuid"))); //新增访客模式，访客模式下模拟登录，每次新增用户 - if (String.valueOf(params.get("username")).contains("guest")) { - SysUserDTO userDTO = new SysUserDTO(); - userDTO.setStatus(1); - userDTO.setPassword(String.valueOf(params.get("password"))); - userDTO.setUsername(String.valueOf(params.get("username"))); - userDTO.setSuperAdmin(0); - userDTO.setDeptId(sysDeptDao.getByName("访客部门") == null ? null : sysDeptDao.getByName("访客部门").getId()); - userDTO.setDeptName("访客部门"); - sysUserService.save(userDTO); - } + //if (String.valueOf(params.get("username")).contains("guest")) { + // SysUserDTO userDTO = new SysUserDTO(); + // userDTO.setStatus(1); + // userDTO.setPassword(String.valueOf(params.get("password"))); + // userDTO.setUsername(String.valueOf(params.get("username"))); + // userDTO.setSuperAdmin(0); + // userDTO.setDeptId(sysDeptDao.getByName("访客部门") == null ? null : sysDeptDao.getByName("访客部门").getId()); + // userDTO.setDeptName("访客部门"); + // sysUserService.save(userDTO); + //} //用户信息 SysUserDTO user = sysUserService.getByUsername(login.getUsername()); @@ -118,7 +133,6 @@ public class LoginController { log.setCreateDate(new Date()); log.setIp(IpUtils.getIpAddr(request)); log.setUserAgent(request.getHeader(HttpHeaders.USER_AGENT)); - log.setIp(IpUtils.getIpAddr(request)); //用户不存在 if (user == null) { @@ -129,16 +143,6 @@ public class LoginController { throw new RenException(ErrorCode.ACCOUNT_PASSWORD_ERROR); } - //密码错误 - if (!PasswordUtils.matches(login.getPassword(), user.getPassword())) { - log.setStatus(LoginStatusEnum.FAIL.value()); - log.setCreator(user.getId()); - log.setCreatorName(user.getUsername()); - sysLogLoginService.save(log); - - throw new RenException(ErrorCode.ACCOUNT_PASSWORD_ERROR); - } - //账号停用 if (user.getStatus() == UserStatusEnum.DISABLE.value()) { log.setStatus(LoginStatusEnum.LOCK.value()); @@ -149,11 +153,55 @@ public class LoginController { throw new RenException(ErrorCode.ACCOUNT_DISABLE); } + //2022-11-11 账号锁定 且在规定时间内则不能登录 + if (user.getStatus() == UserStatusEnum.LOCKED.value()) { + Date now = DateUtil.date(); + QueryWrapper queryWrapper = new QueryWrapper<>(); + //queryWrapper.eq("creator_name", params.get("username")).orderByDesc("create_date").last("LIMIT 1"); + queryWrapper.eq("creator_name", userName).orderByDesc("create_date").last("LIMIT 1"); + SysLogLoginEntity loginEntity = logLoginDao.selectOne(queryWrapper); + Date lastLoginDate = loginEntity.getCreateDate(); + //未超过规定时间，返回账户锁定信息 + if (DateUtils.addDateHours(lastLoginDate, resumeLogonTime).after(now)) { + throw new RenException("当前账号为锁定状态，请在" + DateUtils.format(DateUtils.addDateHours(lastLoginDate, resumeLogonTime), DateUtils.DATE_TIME_PATTERN) + "时间后重试。"); + } + + } + + //密码错误 + if (!PasswordUtils.matches(login.getPassword(), user.getPassword())) { + log.setStatus(LoginStatusEnum.FAIL.value()); + log.setCreator(user.getId()); + log.setCreatorName(user.getUsername()); + sysLogLoginService.save(log); + + //2022-11-11 新增限制用户登录次数，超过后账户锁定（状态变为2） + if (user.getFrequency() < maxErrorTimes) { + user.setFrequency(user.getFrequency() + 1); + if (user.getFrequency() == maxErrorTimes) { + user.setStatus(2); + sysUserService.update(user); + throw new RenException("账号或密码连续输入错误" + maxErrorTimes + "次，账号已锁定。"); + } else { + sysUserService.update(user); + throw new RenException("账号或密码输入错误，当前还可输入" + (maxErrorTimes - user.getFrequency()) + "次。"); + } + } + + } + + //登录成功 log.setStatus(LoginStatusEnum.SUCCESS.value()); log.setCreator(user.getId()); log.setCreatorName(user.getUsername()); sysLogLoginService.save(log); + //将用户状态改为正常,登录失败次数置为0 + if (user.getStatus() != 1 || user.getFrequency() != 0) { + user.setStatus(1); + user.setFrequency(0); + sysUserService.update(user); + } Result token = sysUserTokenService.createToken(user.getId()); request.setAttribute(Constant.TOKEN_HEADER, token.getData().get(Constant.TOKEN_HEADER)); diff --git a/renren-admin/src/main/java/io/renren/modules/sys/entity/SysUserEntity.java b/renren-admin/src/main/java/io/renren/modules/sys/entity/SysUserEntity.java index 394de473..9912b0f9 100644 --- a/renren-admin/src/main/java/io/renren/modules/sys/entity/SysUserEntity.java +++ b/renren-admin/src/main/java/io/renren/modules/sys/entity/SysUserEntity.java @@ -83,4 +83,9 @@ public class SysUserEntity extends BaseEntity { */ private String ywMobile; + /** + * 登录失败次数 + */ + private Integer frequency; + } \ No newline at end of file From c844000ff1cda7448ae4faa9ed717af2961b680e Mon Sep 17 00:00:00 2001 From: dinggang <2498628697@qq.com> Date: Mon, 14 Nov 2022 17:02:14 +0800 Subject: [PATCH 2/2] =?UTF-8?q?1.=E7=94=A8=E6=88=B7=E8=A1=A8=E6=96=B0?= =?UTF-8?q?=E5=A2=9E=E5=AD=97=E6=AE=B5?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- renren-admin/src/main/resources/db/V7.2__sys_user_add_col.sql | 1 + 1 file changed, 1 insertion(+) create mode 100644 renren-admin/src/main/resources/db/V7.2__sys_user_add_col.sql diff --git a/renren-admin/src/main/resources/db/V7.2__sys_user_add_col.sql b/renren-admin/src/main/resources/db/V7.2__sys_user_add_col.sql new file mode 100644 index 00000000..19645bce --- /dev/null +++ b/renren-admin/src/main/resources/db/V7.2__sys_user_add_col.sql @@ -0,0 +1 @@ +ALTER TABLE sys_user ADD COLUMN 'frequency' int NULL DEFAULT 0 COMMENT '登录失败次数'; \ No newline at end of file