登陆要求密码必须包含数字、大写字母、小写字母、特殊字字符4种中至少3种

时间 2019-11-24

标签登陆要求密码必须包含数字大写字母小写字母特殊字符至少繁體版

原文原文链接

<!DOCTYPE html>
<html>
<head lang="en">
<meta charset="UTF-8">
<title>修改密码 | ${appName} - ${sysName}</title>
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<title>${appName}-${sysName}</title> <%include("/admin/header.html"){}%>
<script type="text/javascript">
var app="${app}";
</script>
<link rel="stylesheet" href="${app}assets/css/amazeui-qhyf.css">
</head>
<body>
    <div class="am-g" style="padding-top: 3%;">
        <div class="am-u-lg-3 am-u-md-6 am-u-sm-centered loginContent">
            <div class="loginBox">
                <div class="loginTitle">
                    <div class="inner">
                        <i class="title-icon"></i>
                        <h1>${appName}</h1>
                        <span>首次登录请先修改密码</span>
                    </div>
                </div>
                <!-- loginTitle end -->
                <div class="log-mainbox">
                    <form method="post" id="changePasswordForm" class="am-form" 
                        action="${app}password/change">
                        <fieldset>
                            <div class="iptBox ipt-logCon" style="margin-bottom: 30px;">
                                <i class="user"></i> <input name="userName" type="text"
                                    id="userName" minlength="4" placeholder="请输入用户名" required="required" />
                            </div>
                            <div class="iptBox ipt-logCon" style="margin-bottom: 30px;">
                                <i class="pass"></i> <input name="oldPassword" type="password"
                                    id="oldPassword" minlength="6" onblur="javascrpit:checkPassWord()" placeholder="请输入原密码" required/>
                            </div>
                            <div class="iptBox ipt-logCon" style="margin-bottom: 30px;">
                                <i class="pass"></i> <input name="password" type="password"
                                    id="password" minlength="8"placeholder="请输入新密码" required />
                            </div>
                            <div class="iptBox ipt-logCon" style="margin-bottom: 30px;">
                                <i class="pass"></i> <input name="passwordConfirm" type="password"
                                    id="passwordConfirm" data-equal-to="#password" minlength="8" placeholder="请再次输入新密码" required="required" />
                            </div>
                           <div class="am-cf" style="margin-bottom: 30px;">
                                <input id="changePasswordBtn" type="button"
                                    class="am-btn am-btn-primary am-btn-sm am-fl log-sendBox log-sendshadowFont log-sendBoxShadow "
                                    value="修改密码" />
                            </div>
                            <span style="color:#FFFFFF;font-size: 5px;margin-left: 0px">新密码必须包含数字、大写字母、小写字母、特殊字字符至少3种,长度必须大于或等于8位</span>
                        </fieldset>
                    </form>
                </div>
                <!-- log-mainbox end -->

            </div>
            <div class="loginShadow" style="margin-top: 10px;">
                <img src="${app}assets/i/image/loginShadow.jpg">
            </div>
        </div>
    </div>
    <div class="admin-tpl" id="templateDiv">
    
    <%include("/admin/template/modal.tpl"){}%>
    </div>
    <div id="modal-div"></div>
    <script src="${app}assets/js/jquery.min.js"></script>
    <script src="${app}assets/js/admin/admin.js"></script>
    <script src="${app}assets/js/admin/admin.utils.js"></script>
    <script src="${app}assets/js/amazeui.min.js"></script>
    <script src="${app}assets/js/handlebars.min.js"></script>
    <script type="text/javascript">
     //每一个模块都应该提供一个init方法用来进行事件注册什么的
    function changePasswordAdmin() {
    }// 定义一个类（函数）
    changePasswordAdmin.formId="changePasswordForm";
    changePasswordAdmin.comfirBtnName="肯定";
    changePasswordAdmin.modal=null;
    var $modalTpl = $('#admin-modal-div-tpl');
    var $modalDivName = "#modal-div";
    var $modalDiv = $($modalDivName);
    //为该类（函数）添加一个静态方法extend
    changePasswordAdmin.extend = function(obj) {
        for ( var a in obj)
            this[a] = obj[a];
    }    
    changePasswordAdmin.extend({                 
        init : function(data) {
            //注册新增按钮
            $("#changePasswordBtn").on(
                    'click',function(){
                        commit;
                    });//新增按钮注册结束
            
     },//init End
    commit : function(data) {
            var passwordConfirm = $('#changePasswordForm').find('#passwordConfirm').val();
            var password = $('#changePasswordForm').find('#password')
            .val();
            if (passwordConfirm !== password) {
                alertMsg("初始密码和确认密码必须一致");
                return;
            }
             var $form= $("#"+changePasswordAdmin.formId);
             commitForm($form, changePasswordAdmin.modal,changePasswordAdmin);        
             } 
  });//extend  END
    function checkPassWord(){
        var oldPassword = document.getElementById("oldPassword").value;
        var userName= document.getElementById("userName").value;
     /* var para={};
        para['oldPassword']=oldPassword;
        para['userName']=userName; */
        ajax_jsonp("${app}password/check", {"oldPassword":oldPassword,"userName":userName}, function(response){
            if(response.errmsg=="密码不正确，请从新输入"){
                alert("密码不正确请从新输入");
                //alert("密码不正确请从新输入");
                return;
            }
        },null,"POST");
    }
     $("#changePasswordBtn").on(
                'click',
                function() {
                    var passwordConfirm = $('#changePasswordForm').find(
                        '#passwordConfirm').val();
                    var password = $('#changePasswordForm').find('#password').val();
                    if (passwordConfirm !== password) {
                        alert("新密码和确认密码必须一致");
                        return false;
                    }
                    if (password == "" || password.length < 8) {
                        alert("密码至少为8位");
                        return false;
                    }
                    var passwordFormat = /^(?![a-zA-Z]+$)(?![A-Z0-9]+$)(?![A-Z\\\\W_!@#$%^&*`~()-+=]+$)(?![a-z0-9]+$)(?![a-z\\\\W_!@#$%^&*`~()-+=]+$)(?![0-9\\\\W_!@#$%^&*`~()-+=]+$)[a-zA-Z0-9\\\\W_!@#$%^&*`~()-+=]{8,30}$/
                    if (!passwordFormat.test(password)) {
                        alert("新密码必须包含数字、大写字母、小写字母、特殊字字符4种中至少3种");
                        return;
                    }
                    if (!passwordFormat.test(passwordConfirm)) {
                        alert("确认密码必须包含数字、大写字母、小写字母、特殊字字符4种中至少3种");
                        return;
                    }
                     var $form= $("#"+changePasswordAdmin.formId);
//                      commitForm($form, changePasswordAdmin.modal,changePasswordAdmin);
                        // 异步提交
                    var formData = $form.serializeArray();
                    var data = {};
                    $.each(formData, function(index, object) {
                        data[object.name] = object.value;
                    });    
                    
                    url = build_url("${app}password/change");
                    $.ajax({
                        async: true,
                        data: data,
                        url: url,
                        dataType: "json",
                        type: "POST"
                    }).then(function(data, status) {
                        if(!checkResponseData(data)) {
                            if(data && data.errmsg) {
                                alert(data.errmsg);
                                $("#userName").val("");
                                $("#oldPassword").val("");
                                $("#password").val("");
                                $("#passwordConfirm").val("");
                                return;
                            } else {
                                console.error("发生未知错误");
                            }
                        }
                    }, function(data, status, errorThrown) {
                        if(data.status && data.status === 200) {
                            document.write(data.responseText);
                            return;
                        }
                    });
                });
    </script>
</body>
</html>

<!DOCTYPE html>
<html>
<head lang="en">
<meta charset="UTF-8">
<title>登录 | ${appName} - ${sysName}</title>
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<title>${appName}-${sysName}</title> <%include("/admin/header.html"){}%>
<script>
    if (!endWith(window.location.href, "/login")
            && !endWith(window.location.href, "/login/")) {
        console.log("非登录地址，从新刷新一次登录界面");
        window.location.href = "${app}login";
    }
    $(function() {
        var loginMsg = "${loginErrMsg!}";
        if (loginMsg != "") {
            alert(loginMsg);
        }
    });
    $(function() {
        var needPhoneCheck = "${needPhoneCheck!}";
        if (needPhoneCheck) {
            $("#identifyingCode").parent(".iptBox").css('display','block');
            if("1"==needPhoneCheck){
                $("#resend").css('display','block');
                settime($("#resend"));
            }else if("2"==needPhoneCheck){
                $("#resend").css('display','block');
            }
        }
    });
    $(function() {
        var obj = $("#resend");
        var countdown = "${countdown!}";
        settime(obj);
    });
</script>
</head>
<body>
    <div class="am-g" style="padding-top: 3%;">
        <div class="am-u-lg-3 am-u-md-6 am-u-sm-centered loginContent">
            <div class="loginBox">
                <div class="loginTitle">
                    <div class="inner">
                        <i class="title-icon"></i>
                        <h1>${appName}</h1>
                        <span>您好！欢迎进入${appName}！</span>
                    </div>
                </div>
                <!-- loginTitle end -->
                <div class="log-mainbox">
                    <form method="post" class="am-form" action="${app}action/login" id="form">
                        <fieldset>
                            <div class="iptBox ipt-logCon" style="margin-bottom: 30px;">
                                <i class="user"></i> <input name="userName" type="text"
                                    value="${loginUserId!}" id="userName" minlength="4"
                                    placeholder="用户名" required />
                                    <input name="mobile" type="hidden"
                                    value="${mobile!}" id="mobile"/>
                                    <input name="countdown" type="hidden"
                                    value="${countdown!}" id="countdown"/>
                            </div>
                            <div class="iptBox ipt-logCon" style="margin-bottom: 30px;">
                                <i class="pass"></i> <input name="password" type="password"
                                    id="password" minlength="6" placeholder="密码" required />
                            </div>
                            <div class="iptBox ipt-logCon" style="margin-bottom: 30px;display:none; width:158px;">
                                <i class="pass"></i> <input name="identifyingCode" type="text"
                                    id="identifyingCode" minlength="6" placeholder="验证码"/>
                            </div>
                            <input type="button" id="resend" value="从新发送"  style="margin-top: -68px;width: 150px;height: 39px;float: right;display: none;border-radius: 5px;background: #E6E6E6;"/> 
                            <div class="am-cf" style="margin-bottom: 30px;">
                                <input type="button"
                                    class="am-btn am-btn-primary am-btn-sm am-fl log-sendBox log-sendshadowFont log-sendBoxShadow " onclick="check()"
                                    value="登   录" />
                            </div>
                        </fieldset>
                    </form>
                    <!--                     <div class="log-forgetcon"> -->
                    <!--                         <a href="javascript:void(0);" class="log-forget"> <i></i> -->
                    <!--                             忘记密码？ -->
                    <!--                         </a> -->
                    <!--                     </div> -->
                </div>
                <!-- log-mainbox end -->

            </div>
            <div class="loginShadow" style="margin-top: 10px;">
                <img src="${app}assets/i/image/loginShadow.jpg">
            </div>
        </div>
    </div>

</body>
<script src="${app}assets/js/admin/admin.js"></script>
<script type="text/javascript">
    if($("#countdown").val()!=""){
        var countdown=$("#countdown").val();
    }else{
        var countdown=120; 
    }
    $("#resend").on("click",function(){
        var obj = $("#resend");
        resend();
        settime(obj);
    })
    function settime(obj) { //发送验证码倒计时
        if (countdown == 0) { 
            obj.attr('disabled',false);  
            obj.val("获取验证码");
            $("#resend").css("background","#E6E6E6");
            $("#countdown").val("120");
            countdown = 120; 
            return;
        } else { 
            obj.attr('disabled',true);
            obj.val("(" + countdown + ")S");
            $("#countdown").val(""+ countdown +"");
            countdown--; 
        } 
    setTimeout(function() { 
        settime(obj) }
        ,1000) 
    }
    function resend(){    
        $("#countdown").val("120");
        $.ajax({
             type: "POST",
             url: "/action/login/",
             data: {"mobile" : $("#mobile").val(),"flag":"1"},
             dataType: "json",
             success: function(data){}
         });
    }
    function check() {
        var passwordFormat = /^(?![a-zA-Z]+$)(?![A-Z0-9]+$)(?![A-Z\\\\W_!@#$%^&*`~()-+=]+$)(?![a-z0-9]+$)(?![a-z\\\\W_!@#$%^&*`~()-+=]+$)(?![0-9\\\\W_!@#$%^&*`~()-+=]+$)[a-zA-Z0-9\\\\W_!@#$%^&*`~()-+=]{8,30}$/
        var commitFlag = false
        if ($("#password").val().length < 8||!passwordFormat.test($("#password").val())) {
            commitFlag = alertMsg("密码必须包含数字、大写字母、小写字母、特殊字字符至少3种,长度必须大于或等于8位.是否修改",'COMFIR');
            if(commitFlag){
                document.getElementById('form').submit();
            }
        } else {              88888888
            document.getElementById('form').submit(); //验证成功进行表单提交
        }
    }
</script>
</html>

import java.io.BufferedReader;
import java.io.InputStreamReader;
import java.net.HttpURLConnection;
import java.net.InetAddress;
import java.net.URL;
import java.net.UnknownHostException;
import java.util.HashMap;
import java.util.Map;
import java.util.regex.Matcher;
import java.util.regex.Pattern;

import javax.servlet.http.HttpServletRequest;

import org.apache.commons.lang3.StringUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import com.aliyuncs.exceptions.ClientException;
import com.google.common.io.BaseEncoding;
import com.jfinal.core.ActionKey;
import com.jfinal.core.action.Rest;
import com.jfinal.core.pojo.RestMethod;
import com.qhyf.app.bl.BlConfig;
import com.qhyf.app.bl.BlConstant;
import com.qhyf.app.bl.base.common.AdminService;
import com.qhyf.app.bl.base.common.EnvironmentUtils;
import com.qhyf.app.bl.base.support.SuppliersToken;
import com.qhyf.app.bl.base.util.SmsUtils;
import com.qhyf.app.bl.base.util.VerifyCodeUtil;
import com.qhyf.app.bl.model.SysUser;
import club.newepoch.persistent.db.common.Db;
import club.newepoch.persistent.db.exception.ActiveRecordException;
import club.newepoch.persistent.db.pojo.Record;
import club.newepoch.utils.AssertUtils;



public class LoginController extends QhyfController {

    /**
     * 日志
     */
    private static  Logger logger = LoggerFactory.getLogger(LoginController.class);

    /**
     * 筛选用户
     */
    private static String selectUser = "SELECT * FROM `sys_user` WHERE `sys_status`=? AND `user_id`=?";

    /**
     * 注销
     */
    @ActionKey("/logout")
    public void logout() {
        Record loginUser = AdminService.getLoginUser(this);
        if (loginUser != null) {
            AdminService.logout(this, loginUser);
        } else {
            redirect("/");
        }
    }

    /**
     * 打开登录界面
     */
    public void index() {
//        String nesid = AdminService.getNesid(this);
//        if (!StringUtils.isBlank(nesid)) {
//            Record user = AdminService.getLoginUser(this);
//            if (AdminService.isValidSession(nesid, user)) {
//                // 已登录，直接跳转到主界面
//                logger.info("用户[{}]已登录(nesid=[{}],直接跳转到登录界面", user.getStr(BlConstant.FIELD_USER_ID), nesid);
//                redirect("/admin/");
//                return;
//            }
//        }
        render("/admin/login.html");
    }

    /**
     * 修改密码
     */
    @Rest(method = RestMethod.GET)
    @ActionKey("/password/change")
    public void changePassword() {
        this.render("/admin/changePassword.html");
    }
    
    /**
     * 修改密码
     */
    @Rest(method = RestMethod.POST)
    @ActionKey("/password/change")
    public void doChangePassword() {
        Record loginUser = null;
        try {
            String userName = this.getPara("userName");
            AssertUtils.notBlank(userName, "用户名不能为空");
            String oldPassword = this.getPara("oldPassword");
            AssertUtils.notBlank(oldPassword, "登录密码不能为空");
            String password = this.getPara("password");
            AssertUtils.notBlank(password, "新密码不能为空");
            String passwordConfirm = this.getPara("passwordConfirm");
            AssertUtils.notBlank(passwordConfirm, "确认密码不能为空");
            AssertUtils.isTrue(password.equals(passwordConfirm), "新密码和确认密码必须一致");
            String sql = selectUser;
            loginUser = Db.findFirst(sql, BlConstant.SYS_STATUS_VALUE, userName);
            AssertUtils.notNull(loginUser, "登录帐号不存在或密码错误");
            this.checkPassword(loginUser, userName, oldPassword);
            String newPasswordMd5 = AdminService.getUserPassword(loginUser.getStr(BlConstant.FIELD_SALT),
                    passwordConfirm);
            Db.update("update " + SysUser.dao.getTable().getName() + " set status='1',password=? where uuid=?",
                    newPasswordMd5, loginUser.getStr(BlConstant.FIELD_UUID));
            loginUser.set("password", newPasswordMd5);
            AdminService.login(this, loginUser);
            // this.renderVjson("密码修改为功");
            // redirect("/admin/");
            logger.debug("密码修改为功，跳转到后台界面");
//bug对应NO.1455---修改完成后界面不跳转 add by dujiang 2016/08/25 start
            render("/admin/login.html");
//            this.redirect(EnvironmentUtils.me().getEnv().getLoginAction());
//bug对应NO.1455---修改完成后界面不跳转 add by dujiang 2016/08/25 end
        } catch (Exception e) {
            logger.error("修改密码失败", e);
//            this.renderVjson("修改密码失败");
            this.renderVerrorJson(2, e.getLocalizedMessage(), e);
        }
    }

    /**
     * 检验密码
     * 
     * @throws ActiveRecordException
     */
    @Rest(method = RestMethod.POST)
    @ActionKey("/password/check")
    public void checkPassword() {
        Record loginUser = null;
        String userName = this.getPara("userName");
        AssertUtils.notBlank(userName, "请先输入用户名");
        String oldPassword = this.getPara("oldPassword");
        AssertUtils.notBlank(oldPassword, "密码不能为空");
        String sql = selectUser;
        try {
            loginUser = Db.findFirst(sql, BlConstant.SYS_STATUS_VALUE, userName);
            AssertUtils.notNull(loginUser, "用户不存在");
            this.checkPassword(loginUser, userName, oldPassword);
            if (loginUser != null) {
                this.renderVjson("密码正确，请继续执行");
            } else {
                logger.error("密码不正确，请从新输入");
                this.renderVjson("密码不正确，请从新输入");
            }
        } catch (Exception e) {
            logger.error("密码不正确，请从新输入", e);
            this.renderVjson("密码不正确，请从新输入");
        }
    }

    /**
     * 登录(登录必须以post方式)
     */
    @Rest(method = RestMethod.POST)
    @ActionKey("/action/login")
    public void loginAction() {
        String mobile = this.getPara("mobile");
        String flag = this.getPara("flag");//是不是从新发送的消息
        String countdown = this.getPara("countdown");
        if("1".equals(flag)){
            resend(mobile);
        }else{
            String userName = this.getPara("userName");
            try {
                Record loginUser = null;
                AssertUtils.notBlank(userName, "登录帐号不能为空");
                String password = this.getPara("password");
                AssertUtils.notBlank(password, "登录密码不能为空");
                String identifyingCode = this.getPara("identifyingCode");
                String sql = selectUser;
                loginUser = Db.findFirst(sql, BlConstant.SYS_STATUS_VALUE, userName);
                if (loginUser != null) {
                    String status = loginUser.getStr("status");
                    AssertUtils.notBlank(status, "帐户异常，请联系管理员");
                    if ("0".equals(status)) {
                        this.setAttr("userName", userName);
                        this.redirect("/admin/changePassword.html");
                        return;
                    }
                    String passwordFormat = "^(?![a-zA-Z]+$)(?![A-Z0-9]+$)(?![A-Z\\\\W_!@#$%^&*`~()-+=]+$)(?![a-z0-9]+$)(?![a-z\\\\W_!@#$%^&*`~()-+=]+$)(?![0-9\\\\W_!@#$%^&*`~()-+=]+$)[a-zA-Z0-9\\\\W_!@#$%^&*`~()-+=]{8,30}$";
                    Pattern pattern=Pattern.compile(passwordFormat);
                    Matcher matcher=pattern.matcher(password);                                  
                    if(password.length()<8||!matcher.matches()){
                        String securityPass = AdminService.getUserPassword(loginUser.getStr(BlConstant.FIELD_SALT), password);
                        AssertUtils.isTrue(loginUser.getStr("password").equals(securityPass),"密码输入不正确，请从新输入");
                        this.redirect("/admin/changePassword.html");
                        return;
                    }
                    AssertUtils.isTrue(!"2".equals(status), "帐户已被锁定");
                }
                if (BlConfig.DEV) {
                    if (loginUser == null) {
                        loginUser = new Record();
                        loginUser.set("userName", "测试用户");
                        loginUser.set(BlConstant.FIELD_UUID, userName);
                        loginUser.set(BlConstant.FIELD_USER_ID, userName);
                        loginUser.set(BlConstant.FIELD_CORDYS_USER_ID, userName);
                        loginUser.set(BlConstant.FIELD_EXPIRE_TIME, Long.MAX_VALUE);// 测试超时时间为最长
                        loginUser.set(BlConstant.FIELD_CORDYS_USER_ID, userName);
                    }
                } else {
                    AssertUtils.notNull(loginUser, "登录帐号不存在或密码错误");
                    this.checkPassword(loginUser, userName, password);
                    if(EnvironmentUtils.me().getEnv().isWhiteListOnOff()){
                        // 判断条件
                        boolean conditions = StringUtils.isBlank(identifyingCode) && !checkIp();
                        // 若是是供应商或项目公司人员则不须要白名单限制
                        if(AdminService.checkRole(loginUser.getStr("uuid"), "qhyf1024") 
                                || AdminService.checkRole(loginUser.getStr("uuid"), "qhyf1050")
                                || AdminService.checkRole(loginUser.getStr("uuid"), "qhyf1026")
                                || AdminService.checkRole(loginUser.getStr("uuid"), "qhyf1052")
                                || AdminService.checkRole(loginUser.getStr("uuid"), "qhyf1051")){
                            conditions = StringUtils.isBlank(identifyingCode) && false;
                        }
                        if(conditions){
                            mobile = loginUser.getStr("mobile");
                            AssertUtils.notBlank(mobile, "您不在办公区域且预留手机号码为空，不能登陆系统");
                            String code =VerifyCodeUtil.getRandNum();
                            SmsUtils.sendSms(mobile, code);
                            
                            this.setAttr("mobile", mobile);
                            this.setAttr("needPhoneCheck", "1");
                            AssertUtils.isTrue(false, "您的访问ip未在系统白名单呢，请用手机验证的方式登陆");
                        }else if(StringUtils.isNotBlank(identifyingCode)){
                            mobile = loginUser.getStr("mobile");
                            String content = SmsUtils.querySendDetails(mobile, "").getSmsSendDetailDTOs().get(0).getContent();
                            String regex = "\\d*";
                            Pattern p = Pattern.compile(regex);
                            Matcher m = p.matcher(content);
                            while (m.find()) {
                                if (!"".equals(m.group())){
                                    this.setAttr("mobile", mobile);
                                    this.setAttr("needPhoneCheck", "2");
                                    this.setAttr("countdown", countdown);
                                    AssertUtils.isTrue(identifyingCode.equals(m.group()), "验证码错误");
                                }
                            }
                        }
                    }
                    loginUser.set(BlConstant.FIELD_EXPIRE_TIME, this.getQhyfService().getEnv().getLoginExpireTime());
                }
                //跨域登陆，若是供应商在qhyf-bl服务器上登陆，将自动跳转到供应商服务器，并登陆
                //1.先发送token给供应商服务器，并保存缓存
                //2.再带有token参数响应重定向到供应商服务器
                //3.供应商服务器根据token从缓存获取到用户信息，并登陆
                //4.删除供应商服务器的缓存，避免其余地方使用相同的url登陆
                if(AdminService.checkRole(loginUser.getStr("uuid"), "qhyf1024")){
                    SuppliersToken sToken  = new SuppliersToken(loginUser);
                    sToken.postToken(EnvironmentUtils.me().getEnv().getSuppliersAddress() + "/admin/suppliersToken/");
                    redirect(EnvironmentUtils.me().getEnv().getSuppliersAddress() + "/admin/" + "?suppliersToken=" + sToken.getToken());
                    return;
                }
                if (AdminService.checkRole(loginUser.getStr("uuid"), "qhyf1051")) {
                    SuppliersToken sToken  = new SuppliersToken(loginUser);
                    sToken.postToken(EnvironmentUtils.me().getEnv().getSuppliersAddress() + "/admin/suppliersToken/");
                    redirect(EnvironmentUtils.me().getEnv().getSuppliersAddress() + "/cfcaui/suppliersDocumentSeal.html" + "?suppliersToken=" + sToken.getToken());
                    return;
                }
                // 跨域登陆，若是项目公司在qhyf-bl服务器上登陆，将自动跳转到项目公司服务器，并登陆
                if (AdminService.checkRole(loginUser.getStr("uuid"), "qhyf1050")
                        || AdminService.checkRole(loginUser.getStr("uuid"), "qhyf1026")) {
                    SuppliersToken xToken  = new SuppliersToken(loginUser); // SuppliersToken在此处能够通用
                    xToken.postToken(EnvironmentUtils.me().getEnv().getXmgsAddress() + "/admin/suppliersToken/");
                    redirect(EnvironmentUtils.me().getEnv().getXmgsAddress() + "/admin/" + "?suppliersToken=" + xToken.getToken());
                    return;
                }
                if (AdminService.checkRole(loginUser.getStr("uuid"), "qhyf1052")) {
                    SuppliersToken sToken  = new SuppliersToken(loginUser);
                    sToken.postToken(EnvironmentUtils.me().getEnv().getXmgsAddress() + "/admin/suppliersToken/");
                    redirect(EnvironmentUtils.me().getEnv().getXmgsAddress() + "/cfcaui/itemDocumentSeal.html" + "?suppliersToken=" + sToken.getToken());
                    return;
                }
                String nesid = AdminService.login(this, loginUser);
                redirect("/admin/?token=" + nesid);
            } catch (Exception e) {
                logger.error("登陆失败", e);
                this.setAttr("loginUserId", userName);
                this.setAttr("loginErrMsg", e.getMessage());
                this.render("/admin/login.html");
                // this.renderVerrorJson(1, e.getLocalizedMessage());
            }
        }
        
    }
    
    /**
     * 获取Token
     * @return
     */
    @Rest(method = RestMethod.POST)
    @ActionKey("/action/getToken")
    public void getToken() {
        int errcode = 0;
        String errmsg= "";
        Map<String,Object> token=new HashMap<String,Object>();
        long expireTime = EnvironmentUtils.me().getEnv().getLoginExpireTime();
        String userName = this.getPara("userName");
        if(StringUtils.isBlank(userName)){
            errcode = 1001;
            errmsg = "用户名不能为空";    
        }else{
            String password = this.getPara("password");
            if(StringUtils.isBlank(password)){
                errcode = 1002;
                errmsg = "密码不能为空";
            }else{
                try {
                    Record loginUser = Db.findFirst(selectUser, BlConstant.SYS_STATUS_VALUE, userName);
                    if (loginUser != null) {
                        String status = loginUser.getStr("status");
                        if(StringUtils.isBlank(status)){
                            errcode = 1003;
                            errmsg = "帐户异常";
                        }else if ("0".equals(status)) {
                            errcode = 1004;
                            errmsg = "帐户未经过验证";                    
                        }else if("2".equals(status)){
                            errcode = 1005;
                            errmsg = "帐户已被锁定";    
                        }else if("1".equals(status)  ){
                            this.checkPassword(loginUser, userName, password);
                            String nesid = AdminService.login(this, loginUser);
                            token.put("token", nesid);
                            token.put("expire", expireTime);
                        }
                    }else{
                        errcode = 1006;
                        errmsg = "登录帐号不存在或密码错误";
                    }
                    
                } catch (Exception e) {
                    logger.error("登录处理异常:"+e.getMessage(),e);
                    errcode = 9999;
                    errmsg = "登录处理异常:"+e.getMessage();
                }
            }
        }
        this.renderVerrorJson(errcode, errmsg, token);
    }

    /**
     * 修改密码
     * 
     * @param loginUser
     *            登录用户
     * @param loginUserName
     *            登录用户名(邮箱、手机、id)
     * @param password
     *            密碼
     * @return 密文
     */
    private String checkPassword(Record loginUser, String loginUserName, String password) {
        String salt = loginUser.getStr(BlConstant.FIELD_SALT);
        if (StringUtils.isBlank(salt)) {
            salt = this.getQhyfService().getEnv().getSalt();
            logger.debug("用户[%s]未设置[salt]，使用环境变量值[%s]", loginUserName, salt);
        }
        String passwordMd5 = loginUser.getStr("password");
        String securityPass = AdminService.getUserPassword(salt, password);
        if (BlConfig.DEV) {
            logger.error("原密码为:[{}],salt:[{}]", password, salt);
        }
        AssertUtils.isTrue(securityPass.equals(passwordMd5), "密码错误");
        return securityPass;
    }
    
    /**
     * 白名单校验
     * @return
     * @throws ActiveRecordException 
     */
    private Boolean checkIp () throws Exception{
        
        HttpServletRequest request = this.getRequest();
        String hostIp = getV4IP(request);
        logger.info("客户端外网IP为:[{}]", hostIp);
        Record ip = Db.findFirst("SELECT * FROM `biz_ip_white_list` WHERE `status`=? AND `ip`=?", BlConstant.SYS_STATUS_VALUE, hostIp);
        if(ip!=null){
            logger.info("库中IP为:[{}]", ip.getStr("ip"));
            return true;
        }else{
            return false;
        }
    }

    /**
     * 获取客户端外网IP地址 
     * @return
     */
    private String getV4IP(HttpServletRequest request) throws Exception{
        String forwarded  = request.getHeader("X-Forwarded-For");
        logger.info("X-Forwarded-For为:[{}]", forwarded);
        String realip = request.getHeader("X-Real-IP");
        logger.info("X-Real-IP为:[{}]", realip);
        String ip ="";
        //非代理服务器的状况
        if(StringUtils.isEmpty(forwarded)&&StringUtils.isEmpty(realip)){
            String chinaz = "http://ip.chinaz.com";
            StringBuilder inputLine = new StringBuilder();
            String read = "";
            URL url = null;
            HttpURLConnection urlConnection = null;
            BufferedReader in = null;
            url = new URL(chinaz);
            urlConnection = (HttpURLConnection) url.openConnection();
            in = new BufferedReader( new InputStreamReader(urlConnection.getInputStream(),"UTF-8"));
            while((read=in.readLine())!=null){
                inputLine.append(read+"\r\n");
            }
            if(in!=null){
                in.close();
            }
            Pattern p = Pattern.compile("\\<dd class\\=\"fz24\">(.*?)\\<\\/dd>");
            Matcher m = p.matcher(inputLine.toString());
            if(m.find()){
                String ipstr = m.group(1);
                ip = ipstr;
            }
        }else{
            if(forwarded != null && (!"unknown".equalsIgnoreCase(forwarded))){
                ip = forwarded;
            }
            if(forwarded == null || forwarded.length() == 0 || "unknown".equalsIgnoreCase(forwarded)){
                ip = realip;
            }
            if(ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {  
                ip = request.getRemoteAddr();  
                if(ip.equals("127.0.0.1") || ip.equals("0:0:0:0:0:0:0:1")){  
                    //根据网卡取本机配置的IP  
                    InetAddress inet=null;  
                    try {  
                        inet = InetAddress.getLocalHost();  
                    } catch (UnknownHostException e) {  
                        e.printStackTrace();  
                    }  
                    ip= inet.getHostAddress();  
                }  
            }  
            //对于经过多个代理的状况，第一个IP为客户端真实IP,多个IP按照','分割  
            if(ip!=null && ip.length()>15){ //"***.***.***.***".length() = 15  
                if(ip.indexOf(",")>0){  
                    ip = ip.substring(0,ip.indexOf(","));  
                }  
            }  
        }
        return ip;
    }
    
    /**
     * 从新发送手机验证信息
     */
    private void resend(String mobile) {
        try {
            Integer totalCount = Integer.valueOf(SmsUtils.querySendDetails(mobile, "").getTotalCount());
            if(totalCount<10){
                String code =VerifyCodeUtil.getRandNum();
                SmsUtils.sendSms(mobile, code);    
                this.setAttr("mobile", mobile);
                this.setAttr("needPhoneCheck", "2");
                AssertUtils.isTrue(false, "已从新发送，请查收");
            }else{
                AssertUtils.isTrue(false, "今日您已用手机验证多达十次以上，请明天再尝试登陆");
            }
        } catch (ClientException e) {
            e.printStackTrace();
        }
    }    
}

登陆 要求 密码必须包含数字、大写字母、小写字母、特殊字字符4种中至少3种

登陆要求密码必须包含数字、大写字母、小写字母、特殊字字符4种中至少3种