wangpeng/yidaima
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Harden front authentication responses

Browse Source
This commit is contained in:
王鹏
2026-05-22 10:01:45 +08:00
parent 276da1cb20
commit 265ec9553b
3 changed files with 105 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
RuoYi-Vue/ruoyi-admin/src/main/java/com/ruoyi/web/controller/front/FrontAuthController.java
View File

@@ -40,7 +40,9 @@ public class FrontAuthController extends BaseController
public AjaxResult login(@RequestBody FrontLoginBody body)
{
AjaxResult ajax = AjaxResult.success();
String token = frontAuthService.login(body.getUsername(), body.getPassword());
String username = body == null ? null : body.getUsername();
String password = body == null ? null : body.getPassword();
String token = frontAuthService.login(username, password);
ajax.put(Constants.TOKEN, token);
return ajax;
}
@@ -48,7 +50,7 @@ public class FrontAuthController extends BaseController
@GetMapping("/profile")
public AjaxResult profile()
{
return AjaxResult.success(frontUserService.selectById(SecurityUtils.getUserId()));
return AjaxResult.success(frontAuthService.profile(SecurityUtils.getUserId()));
}
@PostMapping("/logout")

43
RuoYi-Vue/ruoyi-admin/src/main/java/com/ruoyi/web/service/front/FrontAuthService.java
View File

@@ -25,10 +25,16 @@ public class FrontAuthService
public String login(String username, String password)
{
FrontUser frontUser = frontUserService.selectByUsername(username);
if (frontUser == null)
if (StringUtils.isEmpty(username) || StringUtils.isEmpty(password))
{
throw new ServiceException("前台账号或密码错误");
throw credentialException();
}
FrontUser frontUser = frontUserService.selectByUsername(username);
if (frontUser == null || StringUtils.isEmpty(frontUser.getPassword())
|| !matchesPassword(password, frontUser.getPassword()))
{
throw credentialException();
}
if (UserStatus.DISABLE.getCode().equals(frontUser.getStatus()))
{
@@ -38,10 +44,6 @@ public class FrontAuthService
{
throw new ServiceException("前台账号已删除");
}
if (!SecurityUtils.matchesPassword(password, frontUser.getPassword()))
{
throw new ServiceException("前台账号或密码错误");
}
SysUser tokenUser = new SysUser();
tokenUser.setUserId(frontUser.getUserId());
@@ -55,4 +57,31 @@ public class FrontAuthService
frontUserService.updateLastLoginTime(frontUser.getUserId());
return token;
}
public FrontUser profile(Long userId)
{
FrontUser frontUser = frontUserService.selectById(userId);
if (frontUser != null)
{
frontUser.setPassword(null);
}
return frontUser;
}
private boolean matchesPassword(String password, String encodedPassword)
{
try
{
return SecurityUtils.matchesPassword(password, encodedPassword);
}
catch (IllegalArgumentException e)
{
return false;
}
}
private ServiceException credentialException()
{
return new ServiceException("用户名或密码错误");
}
}