From 2c922395efc2e000e1382a79ab93e1bc47135140 Mon Sep 17 00:00:00 2001
From: puzhibing <393733352@qq.com>
Date: 星期日, 20 九月 2026 14:10:17 +0800
Subject: [PATCH] 修改支付账号和rememberme反序列漏洞
---
ManagementQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/modular/system/controller/system/LoginController.java | 11 +++--------
1 files changed, 3 insertions(+), 8 deletions(-)
diff --git a/ManagementQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/modular/system/controller/system/LoginController.java b/ManagementQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/modular/system/controller/system/LoginController.java
index da6fcff..c8ed1f4 100644
--- a/ManagementQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/modular/system/controller/system/LoginController.java
+++ b/ManagementQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/modular/system/controller/system/LoginController.java
@@ -188,7 +188,6 @@
String username = super.getPara("username").trim();
String password = super.getPara("password").trim();
- String remember = super.getPara("remember");
Integer f = loginFailures.get(username);
f = f == null ? 0 : f;
@@ -233,13 +232,9 @@
Subject currentUser = ShiroKit.getSubject();
UsernamePasswordToken token = new UsernamePasswordToken(username, password.toCharArray());
-
- if ("on".equals(remember)) {
- token.setRememberMe(true);
- } else {
- token.setRememberMe(false);
- }
-
+ // 已关闭 RememberMe：关闭浏览器后必须重新登录
+ token.setRememberMe(false);
+
currentUser.login(token);
ShiroUser shiroUser = ShiroKit.getUser();
--
Gitblit v1.7.1