manager/my-worker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

取消无用的扩展参数用法

Browse Source
This commit is contained in:
thinkgem
2020-04-14 12:00:41 +08:00
parent aee477551e
commit 3e53e5ad71
3 changed files with 29 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
common/src/main/java/com/jeesite/common/web/http/ServletUtils.java
View File

@@ -36,8 +36,7 @@ import com.jeesite.common.mapper.XmlMapper;
*/ */
public class ServletUtils { public class ServletUtils {
public static final String DEFAULT_PARAMS_PARAM = "params"; // 登录扩展参数（JSON字符串）优先级高于扩展参数前缀 public static final String EXT_PARAMS_PREFIX = "param_"; // 扩展参数前缀
public static final String DEFAULT_PARAM_PREFIX_PARAM = "param_"; // 扩展参数前缀
// 定义静态文件后缀；静态文件排除URI地址 // 定义静态文件后缀；静态文件排除URI地址
private static String[] staticFiles; private static String[] staticFiles;
@@ -404,14 +403,14 @@ public class ServletUtils {
* @return 返回Map对象 * @return 返回Map对象
*/ */
public static Map<String, Object> getExtParams(ServletRequest request) { public static Map<String, Object> getExtParams(ServletRequest request) {
Map<String, Object> paramMap = null; // Map<String, Object> paramMap = null;
String params = StringUtils.trim(request.getParameter(DEFAULT_PARAMS_PARAM)); // String params = StringUtils.trim(request.getParameter(DEFAULT_PARAMS_PARAM));
if (StringUtils.isNotBlank(params) && StringUtils.startsWith(params, "{")) { // if (StringUtils.isNotBlank(params) && StringUtils.startsWith(params, "{")) {
paramMap = JsonMapper.fromJson(params, Map.class); // paramMap = JsonMapper.fromJson(params, Map.class);
} else { // } else {
paramMap = getParametersStartingWith(ServletUtils.getRequest(), DEFAULT_PARAM_PREFIX_PARAM); // paramMap = getParametersStartingWith(request, DEFAULT_PARAM_PREFIX_PARAM);
} // }
return paramMap; return getParametersStartingWith(request, EXT_PARAMS_PREFIX);
} }
/** /**

34
modules/core/src/main/java/com/jeesite/common/shiro/filter/FormAuthenticationFilter.java
View File

@@ -46,11 +46,9 @@ import com.jeesite.modules.sys.utils.UserUtils;
*/ */
public class FormAuthenticationFilter extends org.apache.shiro.web.filter.authc.FormAuthenticationFilter { public class FormAuthenticationFilter extends org.apache.shiro.web.filter.authc.FormAuthenticationFilter {
public static final String DEFAULT_CAPTCHA_PARAM = "validCode"; // 验证码 public static final String CAPTCHA_PARAM = "validCode"; // 验证码
public static final String DEFAULT_PARAMS_PARAM = ServletUtils.DEFAULT_PARAMS_PARAM; // 登录附加参数（JSON字符串）优先级高于附加参数前缀 public static final String MESSAGE_PARAM = "message"; // 登录返回消息
public static final String DEFAULT_PARAM_PREFIX_PARAM = ServletUtils.DEFAULT_PARAM_PREFIX_PARAM; // 附加参数前缀 public static final String REMEMBER_USERCODE_PARAM = "rememberUserCode"; // 记住用户名
public static final String DEFAULT_MESSAGE_PARAM = "message"; // 登录返回消息
public static final String DEFAULT_REMEMBER_USERCODE_PARAM = "rememberUserCode"; // 记住用户名
private static final Logger logger = LoggerFactory.getLogger(FormAuthenticationFilter.class); private static final Logger logger = LoggerFactory.getLogger(FormAuthenticationFilter.class);
@@ -63,7 +61,7 @@ public class FormAuthenticationFilter extends org.apache.shiro.web.filter.authc.
*/ */
public FormAuthenticationFilter() { public FormAuthenticationFilter() {
super(); super();
rememberUserCodeCookie = new SimpleCookie(DEFAULT_REMEMBER_USERCODE_PARAM); rememberUserCodeCookie = new SimpleCookie(REMEMBER_USERCODE_PARAM);
rememberUserCodeCookie.setHttpOnly(true); rememberUserCodeCookie.setHttpOnly(true);
rememberUserCodeCookie.setMaxAge(Cookie.ONE_YEAR); rememberUserCodeCookie.setMaxAge(Cookie.ONE_YEAR);
} }
@@ -99,7 +97,7 @@ public class FormAuthenticationFilter extends org.apache.shiro.web.filter.authc.
} }
} }
// 登录成功后，判断是否需要记住用户名 // 登录成功后，判断是否需要记住用户名
if (WebUtils.isTrue(request, DEFAULT_REMEMBER_USERCODE_PARAM)) { if (WebUtils.isTrue(request, REMEMBER_USERCODE_PARAM)) {
rememberUserCodeCookie.setValue(EncodeUtils.encodeUrl(EncodeUtils.xssFilter(username))); rememberUserCodeCookie.setValue(EncodeUtils.encodeUrl(EncodeUtils.xssFilter(username)));
rememberUserCodeCookie.saveTo((HttpServletRequest)request, (HttpServletResponse)response); rememberUserCodeCookie.saveTo((HttpServletRequest)request, (HttpServletResponse)response);
} else { } else {
@@ -152,9 +150,9 @@ public class FormAuthenticationFilter extends org.apache.shiro.web.filter.authc.
* 获取登录验证码 * 获取登录验证码
*/ */
protected String getCaptcha(ServletRequest request) { protected String getCaptcha(ServletRequest request) {
String captcha = WebUtils.getCleanParam(request, DEFAULT_CAPTCHA_PARAM); String captcha = WebUtils.getCleanParam(request, CAPTCHA_PARAM);
if (StringUtils.isBlank(captcha)){ if (StringUtils.isBlank(captcha)){
captcha = ObjectUtils.toString(request.getAttribute(DEFAULT_CAPTCHA_PARAM), StringUtils.EMPTY); captcha = ObjectUtils.toString(request.getAttribute(CAPTCHA_PARAM), StringUtils.EMPTY);
} }
// 登录用户名解密（解决登录用户名明文传输安全问题） // 登录用户名解密（解决登录用户名明文传输安全问题）
String secretKey = Global.getProperty("shiro.loginSubmit.secretKey"); String secretKey = Global.getProperty("shiro.loginSubmit.secretKey");
@@ -268,7 +266,7 @@ public class FormAuthenticationFilter extends org.apache.shiro.web.filter.authc.
logger.error(message, e); // 输出到日志文件 logger.error(message, e); // 输出到日志文件
} }
request.setAttribute(getFailureKeyAttribute(), className); request.setAttribute(getFailureKeyAttribute(), className);
request.setAttribute(DEFAULT_MESSAGE_PARAM, message); request.setAttribute(MESSAGE_PARAM, message);
// 登录操作如果是Ajax操作，直接返回登录信息字符串。 // 登录操作如果是Ajax操作，直接返回登录信息字符串。
if (ServletUtils.isAjaxRequest(((HttpServletRequest) request))){ if (ServletUtils.isAjaxRequest(((HttpServletRequest) request))){
@@ -290,7 +288,7 @@ public class FormAuthenticationFilter extends org.apache.shiro.web.filter.authc.
// 获取登录参数 // 获取登录参数
Map<String, Object> paramMap = ServletUtils.getExtParams(request); Map<String, Object> paramMap = ServletUtils.getExtParams(request);
for (Entry<String, Object> entry : paramMap.entrySet()){ for (Entry<String, Object> entry : paramMap.entrySet()){
data.put(DEFAULT_PARAM_PREFIX_PARAM + entry.getKey(), entry.getValue()); data.put(ServletUtils.EXT_PARAMS_PREFIX + entry.getKey(), entry.getValue());
} }
// 如果已登录，再次访问主页，则退出原账号。 // 如果已登录，再次访问主页，则退出原账号。
@@ -319,10 +317,9 @@ public class FormAuthenticationFilter extends org.apache.shiro.web.filter.authc.
String username = WebUtils.getCleanParam(request, DEFAULT_USERNAME_PARAM); String username = WebUtils.getCleanParam(request, DEFAULT_USERNAME_PARAM);
boolean rememberMe = WebUtils.isTrue(request, DEFAULT_REMEMBER_ME_PARAM); boolean rememberMe = WebUtils.isTrue(request, DEFAULT_REMEMBER_ME_PARAM);
boolean rememberUserCode = WebUtils.isTrue(request, DEFAULT_REMEMBER_USERCODE_PARAM); boolean rememberUserCode = WebUtils.isTrue(request, REMEMBER_USERCODE_PARAM);
String params = WebUtils.getCleanParam(request, DEFAULT_PARAMS_PARAM);
String exception = (String)request.getAttribute(DEFAULT_ERROR_KEY_ATTRIBUTE_NAME); String exception = (String)request.getAttribute(DEFAULT_ERROR_KEY_ATTRIBUTE_NAME);
String message = (String)request.getAttribute(DEFAULT_MESSAGE_PARAM); String message = (String)request.getAttribute(MESSAGE_PARAM);
String secretKey = Global.getProperty("shiro.loginSubmit.secretKey"); String secretKey = Global.getProperty("shiro.loginSubmit.secretKey");
if (StringUtils.isNotBlank(secretKey)){ if (StringUtils.isNotBlank(secretKey)){
@@ -331,14 +328,13 @@ public class FormAuthenticationFilter extends org.apache.shiro.web.filter.authc.
data.put(DEFAULT_USERNAME_PARAM, username); data.put(DEFAULT_USERNAME_PARAM, username);
data.put(DEFAULT_REMEMBER_ME_PARAM, rememberMe); data.put(DEFAULT_REMEMBER_ME_PARAM, rememberMe);
data.put(DEFAULT_REMEMBER_USERCODE_PARAM, rememberUserCode); data.put(REMEMBER_USERCODE_PARAM, rememberUserCode);
data.put(DEFAULT_PARAMS_PARAM, params);
Map<String, Object> paramMap = ServletUtils.getExtParams(request); Map<String, Object> paramMap = ServletUtils.getExtParams(request);
for (Entry<String, Object> entry : paramMap.entrySet()){ for (Entry<String, Object> entry : paramMap.entrySet()){
data.put(DEFAULT_PARAM_PREFIX_PARAM + entry.getKey(), entry.getValue()); data.put(ServletUtils.EXT_PARAMS_PREFIX + entry.getKey(), entry.getValue());
} }
data.put(DEFAULT_ERROR_KEY_ATTRIBUTE_NAME, exception); // data.put(DEFAULT_ERROR_KEY_ATTRIBUTE_NAME, exception);
data.put(DEFAULT_MESSAGE_PARAM, message); data.put(MESSAGE_PARAM, message);
// 非授权异常，登录失败，验证码加1。 // 非授权异常，登录失败，验证码加1。
if (!UnauthorizedException.class.getName().equals(exception)){ if (!UnauthorizedException.class.getName().equals(exception)){

13
modules/core/src/main/java/com/jeesite/modules/sys/web/LoginController.java
View File

@@ -4,7 +4,6 @@
package com.jeesite.modules.sys.web; package com.jeesite.modules.sys.web;
import java.util.List; import java.util.List;
import java.util.Map;
import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse; import javax.servlet.http.HttpServletResponse;
@@ -72,9 +71,8 @@ public class LoginController extends BaseController{
return loginFailure(request, response, model); return loginFailure(request, response, model);
} }
// 获取登录失败数据 // 获取登录数据
Map<String, Object> data = FormAuthenticationFilter.getLoginData(request, response); model.addAllAttributes(FormAuthenticationFilter.getLoginData(request, response));
model.addAllAttributes(data);
// 如果是Ajax请求，返回Json字符串。 // 如果是Ajax请求，返回Json字符串。
if (ServletUtils.isAjaxRequest((HttpServletRequest)request)){ if (ServletUtils.isAjaxRequest((HttpServletRequest)request)){
@@ -83,7 +81,7 @@ public class LoginController extends BaseController{
} }
// 返回指定用户类型的登录页视图 // 返回指定用户类型的登录页视图
String userType = (String)data.get(FormAuthenticationFilter.DEFAULT_PARAM_PREFIX_PARAM + "userType"); String userType = (String)model.asMap().get(ServletUtils.EXT_PARAMS_PREFIX + "userType");
if (StringUtils.isBlank(userType)){ if (StringUtils.isBlank(userType)){
userType = User.USER_TYPE_EMPLOYEE; userType = User.USER_TYPE_EMPLOYEE;
} }
@@ -111,8 +109,7 @@ public class LoginController extends BaseController{
} }
// 获取登录失败数据 // 获取登录失败数据
Map<String, Object> data = FormAuthenticationFilter.getLoginFailureData(request, response); model.addAllAttributes(FormAuthenticationFilter.getLoginFailureData(request, response));
model.addAllAttributes(data);
// 如果是Ajax请求，返回Json字符串。 // 如果是Ajax请求，返回Json字符串。
if (ServletUtils.isAjaxRequest(request)){ if (ServletUtils.isAjaxRequest(request)){
@@ -120,7 +117,7 @@ public class LoginController extends BaseController{
} }
// 返回指定用户类型的登录页视图 // 返回指定用户类型的登录页视图
String userType = (String)data.get(FormAuthenticationFilter.DEFAULT_PARAM_PREFIX_PARAM + "userType"); String userType = (String)model.asMap().get(ServletUtils.EXT_PARAMS_PREFIX + "userType");
if (StringUtils.isBlank(userType)){ if (StringUtils.isBlank(userType)){
userType = User.USER_TYPE_EMPLOYEE; userType = User.USER_TYPE_EMPLOYEE;
} }