新增js.window方法，替代top.window

common/src/main/java/com/jeesite/common/codec/DesUtils.java

@@ -73,15 +73,15 @@ public class DesUtils {
 			String encData = "";
 			List firstKeyBt = null, secondKeyBt = null, thirdKeyBt = null;
 			int firstLength = 0, secondLength = 0, thirdLength = 0;
-			if (firstKey != null && firstKey != "") {
+			if (firstKey != null && firstKey.equals("")) {
 				firstKeyBt = getKeyBytes(firstKey);
 				firstLength = firstKeyBt.size();
 			}
-			if (secondKey != null && secondKey != "") {
+			if (secondKey != null && secondKey.equals("")) {
 				secondKeyBt = getKeyBytes(secondKey);
 				secondLength = secondKeyBt.size();
 			}
-			if (thirdKey != null && thirdKey != "") {
+			if (thirdKey != null && thirdKey.equals("")) {
 				thirdKeyBt = getKeyBytes(thirdKey);
 				thirdLength = thirdKeyBt.size();
 			}
@@ -90,7 +90,7 @@ public class DesUtils {
 				if (leng < 4) {
 					int[] bt = strToBt(data);
 					int[] encByte = null;
-					if (firstKey != null && firstKey != "" && secondKey != null && secondKey != "" && thirdKey != null && thirdKey != "") {
+					if (firstKey != null && firstKey.equals("") && secondKey != null && secondKey.equals("") && thirdKey != null && thirdKey.equals("")) {
 						int[] tempBt;
 						int x, y, z;
 						tempBt = bt;
@@ -105,7 +105,7 @@ public class DesUtils {
 						}
 						encByte = tempBt;
 					} else {
-						if (firstKey != null && firstKey != "" && secondKey != null && secondKey != "") {
+						if (firstKey != null && firstKey.equals("") && secondKey != null && secondKey.equals("")) {
 							int[] tempBt;
 							int x, y;
 							tempBt = bt;
@@ -117,7 +117,7 @@ public class DesUtils {
 							}
 							encByte = tempBt;
 						} else {
-							if (firstKey != null && firstKey != "") {
+							if (firstKey != null && firstKey.equals("")) {
 								int[] tempBt;
 								int x = 0;
 								tempBt = bt;
@@ -137,7 +137,7 @@ public class DesUtils {
 						String tempData = data.substring(i * 4 + 0, i * 4 + 4);
 						int[] tempByte = strToBt(tempData);
 						int[] encByte = null;
-						if (firstKey != null && firstKey != "" && secondKey != null && secondKey != "" && thirdKey != null && thirdKey != "") {
+						if (firstKey != null && firstKey.equals("") && secondKey != null && secondKey.equals("") && thirdKey != null && thirdKey.equals("")) {
 							int[] tempBt;
 							int x, y, z;
 							tempBt = tempByte;
@@ -152,7 +152,7 @@ public class DesUtils {
 							}
 							encByte = tempBt;
 						} else {
-							if (firstKey != null && firstKey != "" && secondKey != null && secondKey != "") {
+							if (firstKey != null && firstKey.equals("") && secondKey != null && secondKey.equals("")) {
 								int[] tempBt;
 								int x, y;
 								tempBt = tempByte;
@@ -164,7 +164,7 @@ public class DesUtils {
 								}
 								encByte = tempBt;
 							} else {
-								if (firstKey != null && firstKey != "") {
+								if (firstKey != null && firstKey.equals("")) {
 									int[] tempBt;
 									int x;
 									tempBt = tempByte;
@@ -181,7 +181,7 @@ public class DesUtils {
 						String remainderData = data.substring(iterator * 4 + 0, leng);
 						int[] tempByte = strToBt(remainderData);
 						int[] encByte = null;
-						if (firstKey != null && firstKey != "" && secondKey != null && secondKey != "" && thirdKey != null && thirdKey != "") {
+						if (firstKey != null && firstKey.equals("") && secondKey != null && secondKey.equals("") && thirdKey != null && thirdKey.equals("")) {
 							int[] tempBt;
 							int x, y, z;
 							tempBt = tempByte;
@@ -196,7 +196,7 @@ public class DesUtils {
 							}
 							encByte = tempBt;
 						} else {
-							if (firstKey != null && firstKey != "" && secondKey != null && secondKey != "") {
+							if (firstKey != null && firstKey.equals("") && secondKey != null && secondKey.equals("")) {
 								int[] tempBt;
 								int x, y;
 								tempBt = tempByte;
@@ -208,7 +208,7 @@ public class DesUtils {
 								}
 								encByte = tempBt;
 							} else {
-								if (firstKey != null && firstKey != "") {
+								if (firstKey != null && firstKey.equals("")) {
 									int[] tempBt;
 									int x;
 									tempBt = tempByte;
@@ -236,15 +236,15 @@ public class DesUtils {
 			String decStr = "";
 			List firstKeyBt = null, secondKeyBt = null, thirdKeyBt = null;
 			int firstLength = 0, secondLength = 0, thirdLength = 0;
-			if (firstKey != null && firstKey != "") {
+			if (firstKey != null && firstKey.equals("")) {
 				firstKeyBt = getKeyBytes(firstKey);
 				firstLength = firstKeyBt.size();
 			}
-			if (secondKey != null && secondKey != "") {
+			if (secondKey != null && secondKey.equals("")) {
 				secondKeyBt = getKeyBytes(secondKey);
 				secondLength = secondKeyBt.size();
 			}
-			if (thirdKey != null && thirdKey != "") {
+			if (thirdKey != null && thirdKey.equals("")) {
 				thirdKeyBt = getKeyBytes(thirdKey);
 				thirdLength = thirdKeyBt.size();
 			}
@@ -260,7 +260,7 @@ public class DesUtils {
 					intByte[j] = Integer.parseInt(strByte.substring(j, j + 1));
 				}
 				int[] decByte = null;
-				if (firstKey != null && firstKey != "" && secondKey != null && secondKey != "" && thirdKey != null && thirdKey != "") {
+				if (firstKey != null && firstKey.equals("") && secondKey != null && secondKey.equals("") && thirdKey != null && thirdKey.equals("")) {
 					int[] tempBt;
 					int x, y, z;
 					tempBt = intByte;
@@ -275,7 +275,7 @@ public class DesUtils {
 					}
 					decByte = tempBt;
 				} else {
-					if (firstKey != null && firstKey != "" && secondKey != null && secondKey != "") {
+					if (firstKey != null && firstKey.equals("") && secondKey != null && secondKey.equals("")) {
 						int[] tempBt;
 						int x, y, z;
 						tempBt = intByte;
@@ -287,7 +287,7 @@ public class DesUtils {
 						}
 						decByte = tempBt;
 					} else {
-						if (firstKey != null && firstKey != "") {
+						if (firstKey != null && firstKey.equals("")) {
 							int[] tempBt;
 							int x, y, z;
 							tempBt = intByte;

modules/core/src/main/java/com/jeesite/common/shiro/filter/FormAuthenticationFilter.java

@@ -65,9 +65,10 @@ public class FormAuthenticationFilter extends org.apache.shiro.web.filter.authc.
 	 */
 	public FormAuthenticationFilter() {
 		super();
-		rememberUserCodeCookie = new SimpleCookie(REMEMBER_USERCODE_PARAM);
+		rememberUserCodeCookie = new SimpleCookie();
-		rememberUserCodeCookie.setHttpOnly(true);
+		rememberUserCodeCookie.setName(REMEMBER_USERCODE_PARAM);
-        rememberUserCodeCookie.setMaxAge(Cookie.ONE_YEAR);
+		rememberUserCodeCookie.setPath(Global.getProperty("session.sessionIdCookiePath"));
+		rememberUserCodeCookie.setSecure(Global.getPropertyToBoolean("session.sessionIdCookieSecure", "false"));
         instance = this;
 	}
 	

modules/core/src/main/java/com/jeesite/modules/config/ShiroConfig.java

@@ -130,10 +130,10 @@ public class ShiroConfig {
 	 * Shiro认证过滤器
 	 */
 	@Bean
-	public ShiroFilterFactoryBean shiroFilter(WebSecurityManager securityManager,
+	public ShiroFilterFactoryBean shiroFilter(WebSecurityManager webSecurityManager,
 			AuthorizingRealm authorizingRealm, CasAuthorizingRealm casAuthorizingRealm) {
 		ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();
-		bean.setSecurityManager(securityManager);
+		bean.setSecurityManager(webSecurityManager);
 		bean.setLoginUrl(Global.getProperty("shiro.loginUrl"));
 		bean.setSuccessUrl(Global.getProperty("adminPath")+"/index");
 		Map<String, Filter> filters = bean.getFilters();
@@ -187,7 +187,7 @@ public class ShiroConfig {
 	 * 定义Shiro安全管理配置
 	 */
 	@Bean
-	public WebSecurityManager securityManager(AuthorizingRealm authorizingRealm,
+	public WebSecurityManager webSecurityManager(AuthorizingRealm authorizingRealm,
 			CasAuthorizingRealm casAuthorizingRealm, SessionManager sessionManager,
 			CacheManager shiroCacheManager) {
 		WebSecurityManager bean = new WebSecurityManager();
@@ -226,20 +226,20 @@ public class ShiroConfig {
 	 * 启用Shrio授权注解拦截方式，AOP式方法级权限检查
 	 */
 	@Bean
-	public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(WebSecurityManager securityManager) {
+	public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(WebSecurityManager webSecurityManager) {
 		AuthorizationAttributeSourceAdvisor bean = new AuthorizationAttributeSourceAdvisor();
-		bean.setSecurityManager(securityManager);
+		bean.setSecurityManager(webSecurityManager);
 		return bean;
 	}
 	
 //	/**
-//	 * 在方法中 注入 securityManager 进行代理控制
+//	 * 在方法中 注入 webSecurityManager 进行代理控制
 //	 */
 //	@Bean
-//	public MethodInvokingFactoryBean methodInvokingFactoryBean(DefaultWebSecurityManager securityManager) {
+//	public MethodInvokingFactoryBean methodInvokingFactoryBean(DefaultWebSecurityManager webSecurityManager) {
 //		MethodInvokingFactoryBean bean = new MethodInvokingFactoryBean();
 //		bean.setStaticMethod("org.apache.shiro.SecurityUtils.setSecurityManager");
-//		bean.setArguments(new Object[] { securityManager });
+//		bean.setArguments(new Object[] { webSecurityManager });
 //		return bean;
 //	}
 	

modules/core/src/main/resources/config/jeesite-core.yml

@@ -370,7 +370,8 @@ shiro:
   # 是否允许嵌入到外部网站iframe中（true：不限制，false：不允许）
   isAllowExternalSiteIframe: true
   
-  # 是否允许跨域访问 CORS，如果允许，设置允许的域名，全部域名设置*号，如果不允许，此设置应该为空
+  # 是否允许跨域访问 CORS，如果允许，设置允许的域名。当设置'*'号全部域名时，accessControlAllowCredentials应该设置为false。
+  # v4.2.3 开始支持多个域名和模糊匹配，例如：http://*.jeesite.com,http://*.jeesite.net
 #  accessControlAllowOrigin: http://demo.jeesite.com
 #  accessControlAllowOrigin: '*'
 
@@ -378,8 +379,8 @@ shiro:
 #  accessControlAllowMethods: GET, POST, OPTIONS
 #  accessControlAllowHeaders: Origin, No-Cache, X-Requested-With, If-Modified-Since, Pragma, Last-Modified, Cache-Control, Expires, Content-Type, X-E4M-With
 
-  # 是否允许接收跨域的Cookie凭证数据 CORS
+  # 是否允许接收跨域的Cookie凭证数据 CORS，当设置为true时，accessControlAllowOrigin不能设置为'*'。
-#  accessControlAllowCredentials: true
+#  accessControlAllowCredentials: false
   
   # 允许的网站来源地址，不设置为全部地址（避免一些跨站点请求伪造 CSRF、防盗链）
 #  allowReferers: http://127.0.0.1,http://localhost
@@ -406,11 +407,11 @@ shiro:
 #    ${adminPath}/${spring.application.name}/swagger/** = anon
 #    ${adminPath}/** = user
   filterChainDefinitions: |
-    ${adminPath}/sys/corpAdmin/treeData = anon
     ${adminPath}/** = user
   
   # 默认的授权过滤定义，如果在filterChainDefinitions中已经定义，则该定义会被覆盖。
   defaultFilterChainDefinitions: |
+    /tags/* = anon
     /lang/** = anon
     /account/* = anon
     /userfiles/** = anon
@@ -422,6 +423,7 @@ shiro:
     ${adminPath}/login = authc
     ${adminPath}/logout = logout
     ${adminPath}/file/** = user
+    ${adminPath}/sys/corpAdmin/treeData = anon
     ${adminPath}/cms/* = perms[cms:view]
     ${adminPath}/cms/site/select = user
     ${adminPath}/cms/site/* = perms[cms:site:view]
@@ -453,6 +455,10 @@ session:
   # 共享的SessionId的Cookie名称，保存到跟路径下，第三方应用获取。同一域名下多个项目时需设置共享Cookie的名称。
   #shareSessionIdCookieName: ${session.sessionIdCookieName}
 
+  # 仅在 HTTPS 下通信 Cookie 数据
+  #session.sessionIdCookieSecure: false
+  #session.sessionIdCookieHttpOnly: true
+
   # 设置接收SessionId请求参数的名称
   sessionIdParamName: __sid
   

modules/core/src/main/resources/views/error/400.html

@@ -50,7 +50,7 @@ else {
 	</div>
 	<div class="copyright">
 		&copy; ${@DateUtils.getYear()} ${@Global.getConfig('productName')} - Powered By <a
-			href="http://jeesite.com">JeeSite ${@Global.getProperty('jeesiteVersion')}</a>
+			href="http://jeesite.com" target="_blank">JeeSite ${@Global.getProperty('jeesiteVersion')}</a>
 	</div>
 </div>
 <% } %>

modules/core/src/main/resources/views/error/403.html

@@ -37,7 +37,7 @@ else {
 	</div>
 	<div class="copyright">
 		&copy; ${@DateUtils.getYear()} ${@Global.getConfig('productName')} - Powered By <a
-			href="http://jeesite.com">JeeSite ${@Global.getProperty('jeesiteVersion')}</a>
+			href="http://jeesite.com" target="_blank">JeeSite ${@Global.getProperty('jeesiteVersion')}</a>
 	</div>
 </div>
 <% } %>

modules/core/src/main/resources/views/error/404.html

@@ -39,7 +39,7 @@ else {
 	</div>
 	<div class="copyright">
 		&copy; ${@DateUtils.getYear()} ${@Global.getConfig('productName')} - Powered By <a
-			href="http://jeesite.com">JeeSite ${@Global.getProperty('jeesiteVersion')}</a>
+			href="http://jeesite.com" target="_blank">JeeSite ${@Global.getProperty('jeesiteVersion')}</a>
 	</div>
 </div>
 <% } %>

modules/core/src/main/resources/views/error/500.html

@@ -45,7 +45,7 @@ else {
 	</div>
 	<div class="copyright">
 		&copy; ${@DateUtils.getYear()} ${@Global.getConfig('productName')} - Powered By <a
-			href="http://jeesite.com">JeeSite ${@Global.getProperty('jeesiteVersion')}</a>
+			href="http://jeesite.com" target="_blank">JeeSite ${@Global.getProperty('jeesiteVersion')}</a>
 	</div>
 </div>
 <% if (@Global.getPropertyToBoolean('error.page.printErrorInfo', 'true')

modules/core/src/main/resources/views/include/sysIndex/topMenuCorp.html

@@ -16,7 +16,7 @@
 				if (corpCode != ''){
 					js.ajaxSubmit("${ctx}/sys/corpAdmin/switch/"+corpCode, function(data){
 						js.showMessage(data.message);
-						top.location.reload();
+						js.window.location.reload();
 					});
 				}
 			}

modules/core/src/main/resources/views/modules/sys/forgetPwd.html

@@ -95,7 +95,7 @@
 	<div class="login-copyright">
 		&copy; ${@DateUtils.getYear()} ${@Global.getConfig('productName')} - Powered By <a
 			id="loginKey" data-key="${@Global.getConfig('shiro.loginSubmit.secretKey')}"
-			href="http://jeesite.com" >JeeSite ${@Global.getProperty('jeesiteVersion')}</a>
+			href="http://jeesite.com" target="_blank">JeeSite ${@Global.getProperty('jeesiteVersion')}</a>
 	</div>
 </div>
 <% } %>

modules/core/src/main/resources/views/modules/sys/registerUser.html

@@ -91,7 +91,7 @@
 	<div class="login-copyright">
 		&copy; ${@DateUtils.getYear()} ${@Global.getConfig('productName')} - Powered By <a
 			id="loginKey" data-key="${@Global.getConfig('shiro.loginSubmit.secretKey')}"
-			href="http://jeesite.com" >JeeSite ${@Global.getProperty('jeesiteVersion')}</a>
+			href="http://jeesite.com" target="_blank">JeeSite ${@Global.getProperty('jeesiteVersion')}</a>
 	</div>
 </div>
 <% } %>

modules/core/src/main/resources/views/modules/sys/switchSkin.html

@@ -158,7 +158,7 @@
 <% } %>
 <script>
 $('.full-opacity-hover').click(function(){
-	top.location = '${ctx}/switchSkin/' + $(this).data('skin');
+	js.window.location = '${ctx}/switchSkin/' + $(this).data('skin');
 });
 
 $('#formLayerModel')
@@ -170,7 +170,7 @@ $('#formLayerModel')
 	$('#tabPageModel').iCheck('uncheck');
 }).on('ifClicked', function(){
 	setTimeout(function(){
-		top.location.reload(true);
+		js.window.location.reload(true);
 	},500);
 });
 
@@ -183,7 +183,7 @@ $('#tabPageModel')
 	js.cookie('tabPageModel', 'false');
 }).on('ifClicked', function(){
 	setTimeout(function(){
-		top.location.reload(true);
+		js.window.location.reload(true);
 	},500);
 });
 </script>

modules/core/src/main/resources/views/modules/sys/sysDesktop.html

@@ -714,7 +714,8 @@
 </div>
 <footer class="main-footer m0">
 	<div class="pull-right hidden-xs">当前版本： ${@Global.getConfig('productVersion')}</div>
-	&copy; ${@DateUtils.getYear()} ${@Global.getConfig('productName')} - Powered By <a href="http://jeesite.com">JeeSite</a>
+	&copy; ${@DateUtils.getYear()} ${@Global.getConfig('productName')} - Powered By
+	<a href="http://jeesite.com" target="_blank">JeeSite</a>
 </footer>
 <% } %>
 <script src="${ctxStatic}/jquery/jquery-ui-sortable-1.12.1.min.js"></script>

modules/core/src/main/resources/views/modules/sys/sysLogin.html

@@ -98,7 +98,7 @@
 	<div class="login-copyright">
 		&copy; ${@DateUtils.getYear()} ${@Global.getConfig('productName')} - Powered By <a
 			id="loginKey" data-key="${@Global.getConfig('shiro.loginSubmit.secretKey')}"
-			href="http://jeesite.com" >JeeSite ${@Global.getProperty('jeesiteVersion')}</a>
+			href="http://jeesite.com" target="_blank">JeeSite ${@Global.getProperty('jeesiteVersion')}</a>
 	</div>
 </div>
 <% } %>

parent/pom.xml

@@ -181,6 +181,7 @@
 				<plugin>
 					<groupId>org.apache.maven.plugins</groupId>
 					<artifactId>maven-war-plugin</artifactId>
+					<version>3.2.3</version>
 					<configuration>
 						<warSourceExcludes>
 							WEB-INF/classes/*.lic,
@@ -222,6 +223,7 @@
 				<plugin>
 					<groupId>org.apache.maven.plugins</groupId>
 					<artifactId>maven-javadoc-plugin</artifactId>
+					<version>3.2.0</version>
 					<executions>
 						<execution>
 							<phase>prepare-package</phase>

web/src/main/resources/config/application.yml

@@ -483,20 +483,21 @@ shiro:
 #  # 是否允许嵌入到外部网站iframe中（true：不限制，false：不允许）
 #  isAllowExternalSiteIframe: true
 #  
-#  # 是否允许跨域访问 CORS，如果允许，设置允许的域名，全部域名设置*号，如果不允许，此设置应该为空
+#  # 是否允许跨域访问 CORS，如果允许，设置允许的域名。当设置'*'号全部域名时，accessControlAllowCredentials应该设置为false。
+#  # v4.2.3 开始支持多个域名和模糊匹配，例如：http://*.jeesite.com,http://*.jeesite.net
 ##  accessControlAllowOrigin: http://demo.jeesite.com
 ##  accessControlAllowOrigin: '*'
 #
-# # 允许跨域访问时 CORS，可以使用的方法和标头
+#  # 允许跨域访问时 CORS，可以使用的方法和标头
-#  accessControlAllowMethods: GET, POST, OPTIONS
+##  accessControlAllowMethods: GET, POST, OPTIONS
-#  accessControlAllowHeaders: Origin, No-Cache, X-Requested-With, If-Modified-Since, Pragma, Last-Modified, Cache-Control, Expires, Content-Type, X-E4M-With
+##  accessControlAllowHeaders: Origin, No-Cache, X-Requested-With, If-Modified-Since, Pragma, Last-Modified, Cache-Control, Expires, Content-Type, X-E4M-With
 #
-#  # 是否允许接收跨域的Cookie凭证数据 CORS
+#  # 是否允许接收跨域的Cookie凭证数据 CORS，当设置为true时，accessControlAllowOrigin不能设置为'*'。
-##  accessControlAllowCredentials: true
+##  accessControlAllowCredentials: false
-#
+#  
-#  # 允许的网站来源地址，不设置为全部地址（避免一些跨站点请求伪造 CSRF）
+#  # 允许的网站来源地址，不设置为全部地址（避免一些跨站点请求伪造 CSRF、防盗链）
-#  allowReferers: http://127.0.0.1,http://localhost
+##  allowReferers: http://127.0.0.1,http://localhost
-#  allowReferers: ~
+##  allowReferers: ~
 #
 #  # 是否在登录后生成新的Session（默认false）
 #  isGenerateNewSessionAfterLogin: false