Ver código fonte

增强权限校验,采用动态登录TOKEN;

xueli.xue 8 anos atrás
pai
commit
049091c4a8

+ 5 - 2
README.md Ver arquivo

@@ -767,9 +767,12 @@ Tips: 历史版本(V1.3.x)目前已经Release至稳定版本, 进入维护阶段
767 767
 - 9、GLUE模式任务实例更新逻辑优化,原根据超时时间更新改为根据版本号更新,源码变动版本号加一;
768 768
 
769 769
 #### 6.12 版本 V1.6.1 特性 (Coding)
770
-- 1、通讯协议二进制据增强校验,处理非正常请求;
770
+- 1、通讯协议二进制据增强校验,拦截非正常请求;
771 771
 - 2、数据库地址配置优化;
772
-- 2、rolling日志,日志界面风格同glue任务编辑器;
772
+- 3、WebIDE交互重构;
773
+- 4、前端部分组件优化;
774
+- 5、增强权限校验,采用动态登录TOKEN;
775
+- 5、rolling日志,日志界面风格同glue任务编辑器;
773 776
 
774 777
 
775 778
 #### TODO LIST

+ 14 - 4
xxl-job-admin/src/main/java/com/xxl/job/admin/controller/interceptor/PermissionInterceptor.java Ver arquivo

@@ -2,11 +2,13 @@ package com.xxl.job.admin.controller.interceptor;
2 2
 
3 3
 import com.xxl.job.admin.controller.annotation.PermessionLimit;
4 4
 import com.xxl.job.admin.core.util.CookieUtil;
5
+import com.xxl.job.admin.core.util.PropertiesUtil;
5 6
 import org.springframework.web.method.HandlerMethod;
6 7
 import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;
7 8
 
8 9
 import javax.servlet.http.HttpServletRequest;
9 10
 import javax.servlet.http.HttpServletResponse;
11
+import java.math.BigInteger;
10 12
 
11 13
 /**
12 14
  * 权限拦截, 简易版
@@ -15,10 +17,16 @@ import javax.servlet.http.HttpServletResponse;
15 17
 public class PermissionInterceptor extends HandlerInterceptorAdapter {
16 18
 	
17 19
 	public static final String LOGIN_IDENTITY_KEY = "LOGIN_IDENTITY";
18
-	public static final String LOGIN_IDENTITY_VAL = "sdf!121sdf$78sd!8";
20
+	public static final String LOGIN_IDENTITY_TOKEN;
21
+    static {
22
+        String username = PropertiesUtil.getString("xxl.job.login.username");
23
+        String password = PropertiesUtil.getString("xxl.job.login.password");
24
+        String temp = username + "_" + password;
25
+        LOGIN_IDENTITY_TOKEN = new BigInteger(1, temp.getBytes()).toString(16);
26
+    }
19 27
 	
20 28
 	public static boolean login(HttpServletResponse response, boolean ifRemember){
21
-		CookieUtil.set(response, LOGIN_IDENTITY_KEY, LOGIN_IDENTITY_VAL, ifRemember);
29
+		CookieUtil.set(response, LOGIN_IDENTITY_KEY, LOGIN_IDENTITY_TOKEN, ifRemember);
22 30
 		return true;
23 31
 	}
24 32
 	public static void logout(HttpServletRequest request, HttpServletResponse response){
@@ -26,7 +34,7 @@ public class PermissionInterceptor extends HandlerInterceptorAdapter {
26 34
 	}
27 35
 	public static boolean ifLogin(HttpServletRequest request){
28 36
 		String indentityInfo = CookieUtil.getValue(request, LOGIN_IDENTITY_KEY);
29
-		if (indentityInfo==null || !LOGIN_IDENTITY_VAL.equals(indentityInfo.trim())) {
37
+		if (indentityInfo==null || !LOGIN_IDENTITY_TOKEN.equals(indentityInfo.trim())) {
30 38
 			return false;
31 39
 		}
32 40
 		return true;
@@ -43,7 +51,9 @@ public class PermissionInterceptor extends HandlerInterceptorAdapter {
43 51
 			HandlerMethod method = (HandlerMethod)handler;
44 52
 			PermessionLimit permission = method.getMethodAnnotation(PermessionLimit.class);
45 53
 			if (permission == null || permission.limit()) {
46
-				throw new Exception("登陆失效");
54
+				response.sendRedirect("/toLogin");
55
+				//request.getRequestDispatcher("/toLogin").forward(request, response);
56
+				return false;
47 57
 			}
48 58
 		}
49 59
 		

+ 2 - 10
xxl-job-admin/src/main/webapp/WEB-INF/template/common/common.exception.ftl Ver arquivo

@@ -22,18 +22,10 @@
22 22
 
23 23
 	<div class="dialog"> 
24 24
 	    <h1>应用程序异常</h1> 
25
-	    <p>抱歉!您访问的页面出现异常,请稍后重试或联系管理员。</p> 
26
-	    <p><a href="javascript:showErr();">详 情</a> 
27
-		<a href="javascript:window.location.href='${request.contextPath}/'">返 回</a> 
25
+	    <p>${exceptionMsg}</p>
26
+		<a href="javascript:window.location.href='${request.contextPath}/'">返 回</a>
28 27
 	    </p> 
29
-	    <div style="display:none;text-align: left;" id="err">${exceptionMsg}</div>
30 28
 	</div>
31
-  
32
-<script type="text/javascript">
33
-function showErr(){
34
-	document.getElementById("err").style.display = "";
35
-}
36
-</script>
37 29
 
38 30
 </body>
39 31
 </html>

+ 2 - 2
xxl-job-admin/src/main/webapp/WEB-INF/template/jobcode/jobcode.index.ftl Ver arquivo

@@ -35,7 +35,7 @@
35 35
                     <#-- left nav -->
36 36
                     <div class="collapse navbar-collapse pull-left" id="navbar-collapse">
37 37
                         <ul class="nav navbar-nav">
38
-                            <li class="active" ><a href="#">任务:${jobInfo.jobDesc}<span class="sr-only">(current)</span></a></li>
38
+                            <li class="active" ><a href="javascript:;">任务:${jobInfo.jobDesc}<span class="sr-only">(current)</span></a></li>
39 39
                         </ul>
40 40
                     </div>
41 41
 
@@ -79,7 +79,7 @@
79 79
         <div class="modal-dialog ">
80 80
             <div class="modal-content">
81 81
                 <div class="modal-header">
82
-                    <h4 class="modal-title" ><i class="fa fa-bars"></i>保存</h4>
82
+                    <h4 class="modal-title" ><i class="fa fa-fw fa-save"></i>保存</h4>
83 83
                 </div>
84 84
                 <div class="modal-body">
85 85
                     <form class="form-horizontal form" role="form" >