From 2c922395efc2e000e1382a79ab93e1bc47135140 Mon Sep 17 00:00:00 2001
From: puzhibing <393733352@qq.com>
Date: 星期日, 20 九月 2026 14:10:17 +0800
Subject: [PATCH] 修改支付账号和rememberme反序列漏洞
---
DriverQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/config/web/ShiroConfig.java | 30 ++----------------------------
1 files changed, 2 insertions(+), 28 deletions(-)
diff --git a/DriverQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/config/web/ShiroConfig.java b/DriverQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/config/web/ShiroConfig.java
index 65f30b0..240abf7 100644
--- a/DriverQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/config/web/ShiroConfig.java
+++ b/DriverQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/config/web/ShiroConfig.java
@@ -5,12 +5,10 @@
import com.stylefeng.guns.core.shiro.ShiroDbRealm;
import org.apache.shiro.cache.CacheManager;
import org.apache.shiro.cache.ehcache.EhCacheManager;
-import org.apache.shiro.codec.Base64;
import org.apache.shiro.session.mgt.SessionManager;
import org.apache.shiro.spring.LifecycleBeanPostProcessor;
import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
-import org.apache.shiro.web.mgt.CookieRememberMeManager;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.apache.shiro.web.servlet.Cookie;
import org.apache.shiro.web.servlet.ShiroHttpSession;
@@ -41,11 +39,10 @@
* 安全管理器
*/
@Bean
- public DefaultWebSecurityManager securityManager(CookieRememberMeManager rememberMeManager, CacheManager cacheShiroManager, SessionManager sessionManager) {
+ public DefaultWebSecurityManager securityManager(CacheManager cacheShiroManager, SessionManager sessionManager) {
DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
securityManager.setRealm(this.shiroDbRealm());
securityManager.setCacheManager(cacheShiroManager);
- securityManager.setRememberMeManager(rememberMeManager);
securityManager.setSessionManager(sessionManager);
return securityManager;
}
@@ -94,29 +91,6 @@
@Bean
public ShiroDbRealm shiroDbRealm() {
return new ShiroDbRealm();
- }
-
- /**
- * rememberMe管理器, cipherKey生成见{@code Base64Test.java}
- */
- @Bean
- public CookieRememberMeManager rememberMeManager(SimpleCookie rememberMeCookie) {
- CookieRememberMeManager manager = new CookieRememberMeManager();
-// manager.setCipherKey(Base64.decode("Z3VucwAAAAAAAAAAAAAAAA=="));
- manager.setCookie(rememberMeCookie);
- return manager;
- }
-
- /**
- * 记住密码Cookie
- */
- @Bean
- public SimpleCookie rememberMeCookie() {
-// SimpleCookie simpleCookie = new SimpleCookie("rememberMe");
- SimpleCookie simpleCookie = new SimpleCookie("");
- simpleCookie.setHttpOnly(true);
- simpleCookie.setMaxAge(7 * 24 * 60 * 60);//7天
- return simpleCookie;
}
/**
@@ -175,7 +149,7 @@
hashMap.put("/login", "anon");
hashMap.put("/global/sessionError", "anon");
hashMap.put("/kaptcha", "anon");
- hashMap.put("/**", "user");
+ hashMap.put("/**", "authc");
shiroFilter.setFilterChainDefinitionMap(hashMap);
return shiroFilter;
}
--
Gitblit v1.7.1