From 2c922395efc2e000e1382a79ab93e1bc47135140 Mon Sep 17 00:00:00 2001
From: puzhibing <393733352@qq.com>
Date: 星期日, 20 九月 2026 14:10:17 +0800
Subject: [PATCH] 修改支付账号和rememberme反序列漏洞
---
UserQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/modular/system/controller/LoginController.java | 8 --
DispatchQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/modular/system/controller/LoginController.java | 8 --
DriverQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/modular/system/controller/LoginController.java | 8 --
DispatchQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/config/web/ShiroConfig.java | 32 +---------
DriverQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/config/web/ShiroConfig.java | 30 ---------
DispatchQYTTravel/guns-admin/src/main/webapp/WEB-INF/view/login.html | 7 --
ManagementQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/modular/system/controller/system/LoginController.java | 11 +--
UserQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/config/web/ShiroConfig.java | 55 +++++++++--------
UserQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/modular/system/util/zhenglian/ZhengLianConfig.java | 16 ++--
9 files changed, 51 insertions(+), 124 deletions(-)
diff --git a/DispatchQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/config/web/ShiroConfig.java b/DispatchQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/config/web/ShiroConfig.java
index 12f66cd..1a40225 100644
--- a/DispatchQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/config/web/ShiroConfig.java
+++ b/DispatchQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/config/web/ShiroConfig.java
@@ -5,12 +5,10 @@
import com.stylefeng.guns.core.shiro.ShiroDbRealm;
import org.apache.shiro.cache.CacheManager;
import org.apache.shiro.cache.ehcache.EhCacheManager;
-import org.apache.shiro.codec.Base64;
import org.apache.shiro.session.mgt.SessionManager;
import org.apache.shiro.spring.LifecycleBeanPostProcessor;
import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
-import org.apache.shiro.web.mgt.CookieRememberMeManager;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.apache.shiro.web.servlet.Cookie;
import org.apache.shiro.web.servlet.ShiroHttpSession;
@@ -39,13 +37,16 @@
/**
* 安全管理器
+ * <p>
+ * 已关闭 RememberMe 功能：DefaultSecurityManager 默认会创建 DefaultRememberMeManager，
+ * 此处必须显式置为 null 才能彻底关闭，避免仍写入 rememberMe cookie。
*/
@Bean
- public DefaultWebSecurityManager securityManager(CookieRememberMeManager rememberMeManager, CacheManager cacheShiroManager, SessionManager sessionManager) {
+ public DefaultWebSecurityManager securityManager(CacheManager cacheShiroManager, SessionManager sessionManager) {
DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
securityManager.setRealm(this.shiroDbRealm());
securityManager.setCacheManager(cacheShiroManager);
- securityManager.setRememberMeManager(rememberMeManager);
+ securityManager.setRememberMeManager(null);
securityManager.setSessionManager(sessionManager);
return securityManager;
}
@@ -94,29 +95,6 @@
@Bean
public ShiroDbRealm shiroDbRealm() {
return new ShiroDbRealm();
- }
-
- /**
- * rememberMe管理器, cipherKey生成见{@code Base64Test.java}
- */
- @Bean
- public CookieRememberMeManager rememberMeManager(SimpleCookie rememberMeCookie) {
- CookieRememberMeManager manager = new CookieRememberMeManager();
-// manager.setCipherKey(Base64.decode("Z3VucwAAAAAAAAAAAAAAAA=="));
- manager.setCookie(rememberMeCookie);
- return manager;
- }
-
- /**
- * 记住密码Cookie
- */
- @Bean
- public SimpleCookie rememberMeCookie() {
-// SimpleCookie simpleCookie = new SimpleCookie("rememberMe");
- SimpleCookie simpleCookie = new SimpleCookie("");
- simpleCookie.setHttpOnly(true);
- simpleCookie.setMaxAge(7 * 24 * 60 * 60);//7天
- return simpleCookie;
}
/**
diff --git a/DispatchQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/modular/system/controller/LoginController.java b/DispatchQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/modular/system/controller/LoginController.java
index f32483a..21f8c6a 100644
--- a/DispatchQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/modular/system/controller/LoginController.java
+++ b/DispatchQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/modular/system/controller/LoginController.java
@@ -88,7 +88,6 @@
String username = super.getPara("username").trim();
String password = super.getPara("password").trim();
- String remember = super.getPara("remember");
//验证验证码是否正确
if (KaptchaUtil.getKaptchaOnOff()) {
@@ -102,12 +101,7 @@
Subject currentUser = ShiroKit.getSubject();
UsernamePasswordToken token = new UsernamePasswordToken(username, password.toCharArray());
- if ("on".equals(remember)) {
- token.setRememberMe(true);
- } else {
- token.setRememberMe(false);
- }
-
+ // 已关闭 RememberMe，token默认rememberMe=false，不再设置"记住我"
currentUser.login(token);
ShiroUser shiroUser = ShiroKit.getUser();
diff --git a/DispatchQYTTravel/guns-admin/src/main/webapp/WEB-INF/view/login.html b/DispatchQYTTravel/guns-admin/src/main/webapp/WEB-INF/view/login.html
index abc8e55..b3c93bf 100644
--- a/DispatchQYTTravel/guns-admin/src/main/webapp/WEB-INF/view/login.html
+++ b/DispatchQYTTravel/guns-admin/src/main/webapp/WEB-INF/view/login.html
@@ -44,13 +44,6 @@
</div>
</div>
@}
- <div class="form-group" style="float: left;">
- <div class="checkbox" style="text-align: left">
- <label>
- <input type="checkbox" name="remember" style="margin-top: 2px;">记住我
- </label>
- </div>
- </div>
<button type="submit" class="btn btn-primary block full-width m-b">登 录</button>
</p>
</form>
diff --git a/DriverQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/config/web/ShiroConfig.java b/DriverQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/config/web/ShiroConfig.java
index 65f30b0..240abf7 100644
--- a/DriverQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/config/web/ShiroConfig.java
+++ b/DriverQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/config/web/ShiroConfig.java
@@ -5,12 +5,10 @@
import com.stylefeng.guns.core.shiro.ShiroDbRealm;
import org.apache.shiro.cache.CacheManager;
import org.apache.shiro.cache.ehcache.EhCacheManager;
-import org.apache.shiro.codec.Base64;
import org.apache.shiro.session.mgt.SessionManager;
import org.apache.shiro.spring.LifecycleBeanPostProcessor;
import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
-import org.apache.shiro.web.mgt.CookieRememberMeManager;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.apache.shiro.web.servlet.Cookie;
import org.apache.shiro.web.servlet.ShiroHttpSession;
@@ -41,11 +39,10 @@
* 安全管理器
*/
@Bean
- public DefaultWebSecurityManager securityManager(CookieRememberMeManager rememberMeManager, CacheManager cacheShiroManager, SessionManager sessionManager) {
+ public DefaultWebSecurityManager securityManager(CacheManager cacheShiroManager, SessionManager sessionManager) {
DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
securityManager.setRealm(this.shiroDbRealm());
securityManager.setCacheManager(cacheShiroManager);
- securityManager.setRememberMeManager(rememberMeManager);
securityManager.setSessionManager(sessionManager);
return securityManager;
}
@@ -94,29 +91,6 @@
@Bean
public ShiroDbRealm shiroDbRealm() {
return new ShiroDbRealm();
- }
-
- /**
- * rememberMe管理器, cipherKey生成见{@code Base64Test.java}
- */
- @Bean
- public CookieRememberMeManager rememberMeManager(SimpleCookie rememberMeCookie) {
- CookieRememberMeManager manager = new CookieRememberMeManager();
-// manager.setCipherKey(Base64.decode("Z3VucwAAAAAAAAAAAAAAAA=="));
- manager.setCookie(rememberMeCookie);
- return manager;
- }
-
- /**
- * 记住密码Cookie
- */
- @Bean
- public SimpleCookie rememberMeCookie() {
-// SimpleCookie simpleCookie = new SimpleCookie("rememberMe");
- SimpleCookie simpleCookie = new SimpleCookie("");
- simpleCookie.setHttpOnly(true);
- simpleCookie.setMaxAge(7 * 24 * 60 * 60);//7天
- return simpleCookie;
}
/**
@@ -175,7 +149,7 @@
hashMap.put("/login", "anon");
hashMap.put("/global/sessionError", "anon");
hashMap.put("/kaptcha", "anon");
- hashMap.put("/**", "user");
+ hashMap.put("/**", "authc");
shiroFilter.setFilterChainDefinitionMap(hashMap);
return shiroFilter;
}
diff --git a/DriverQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/modular/system/controller/LoginController.java b/DriverQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/modular/system/controller/LoginController.java
index f32483a..dbc4278 100644
--- a/DriverQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/modular/system/controller/LoginController.java
+++ b/DriverQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/modular/system/controller/LoginController.java
@@ -88,7 +88,6 @@
String username = super.getPara("username").trim();
String password = super.getPara("password").trim();
- String remember = super.getPara("remember");
//验证验证码是否正确
if (KaptchaUtil.getKaptchaOnOff()) {
@@ -102,11 +101,8 @@
Subject currentUser = ShiroKit.getSubject();
UsernamePasswordToken token = new UsernamePasswordToken(username, password.toCharArray());
- if ("on".equals(remember)) {
- token.setRememberMe(true);
- } else {
- token.setRememberMe(false);
- }
+ // 已关闭 RememberMe 功能，不再写入记住我 Cookie
+ token.setRememberMe(false);
currentUser.login(token);
diff --git a/ManagementQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/modular/system/controller/system/LoginController.java b/ManagementQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/modular/system/controller/system/LoginController.java
index da6fcff..c8ed1f4 100644
--- a/ManagementQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/modular/system/controller/system/LoginController.java
+++ b/ManagementQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/modular/system/controller/system/LoginController.java
@@ -188,7 +188,6 @@
String username = super.getPara("username").trim();
String password = super.getPara("password").trim();
- String remember = super.getPara("remember");
Integer f = loginFailures.get(username);
f = f == null ? 0 : f;
@@ -233,13 +232,9 @@
Subject currentUser = ShiroKit.getSubject();
UsernamePasswordToken token = new UsernamePasswordToken(username, password.toCharArray());
-
- if ("on".equals(remember)) {
- token.setRememberMe(true);
- } else {
- token.setRememberMe(false);
- }
-
+ // 已关闭 RememberMe：关闭浏览器后必须重新登录
+ token.setRememberMe(false);
+
currentUser.login(token);
ShiroUser shiroUser = ShiroKit.getUser();
diff --git a/UserQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/config/web/ShiroConfig.java b/UserQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/config/web/ShiroConfig.java
index a94cf28..7f4481e 100644
--- a/UserQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/config/web/ShiroConfig.java
+++ b/UserQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/config/web/ShiroConfig.java
@@ -5,12 +5,10 @@
import com.stylefeng.guns.core.shiro.ShiroDbRealm;
import org.apache.shiro.cache.CacheManager;
import org.apache.shiro.cache.ehcache.EhCacheManager;
-import org.apache.shiro.codec.Base64;
import org.apache.shiro.session.mgt.SessionManager;
import org.apache.shiro.spring.LifecycleBeanPostProcessor;
import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
-import org.apache.shiro.web.mgt.CookieRememberMeManager;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.apache.shiro.web.servlet.Cookie;
import org.apache.shiro.web.servlet.ShiroHttpSession;
@@ -41,11 +39,10 @@
* 安全管理器
*/
@Bean
- public DefaultWebSecurityManager securityManager(CookieRememberMeManager rememberMeManager, CacheManager cacheShiroManager, SessionManager sessionManager) {
+ public DefaultWebSecurityManager securityManager(CacheManager cacheShiroManager, SessionManager sessionManager) {
DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
securityManager.setRealm(this.shiroDbRealm());
securityManager.setCacheManager(cacheShiroManager);
- securityManager.setRememberMeManager(rememberMeManager);
securityManager.setSessionManager(sessionManager);
return securityManager;
}
@@ -97,27 +94,33 @@
}
/**
- * rememberMe管理器, cipherKey生成见{@code Base64Test.java}
+ * rememberMe已关闭 - 2026-09-20
+ * 原 rememberMeManager 与 rememberMeCookie Bean 已移除，
+ * 登录入口不应再 setRememberMe(true)。
+ * 如需恢复，取消下方注释并恢复 securityManager.setRememberMeManager(...) 即可。
*/
- @Bean
- public CookieRememberMeManager rememberMeManager(SimpleCookie rememberMeCookie) {
- CookieRememberMeManager manager = new CookieRememberMeManager();
-// manager.setCipherKey(Base64.decode("Z3VucwAAAAAAAAAAAAAAAA=="));
- manager.setCookie(rememberMeCookie);
- return manager;
- }
-
- /**
- * 记住密码Cookie
- */
- @Bean
- public SimpleCookie rememberMeCookie() {
-// SimpleCookie simpleCookie = new SimpleCookie("rememberMe");
- SimpleCookie simpleCookie = new SimpleCookie("");
- simpleCookie.setHttpOnly(true);
- simpleCookie.setMaxAge(7 * 24 * 60 * 60);//7天
- return simpleCookie;
- }
+// /**
+// * rememberMe管理器, cipherKey生成见{@code Base64Test.java}
+// */
+// @Bean
+// public CookieRememberMeManager rememberMeManager(SimpleCookie rememberMeCookie) {
+// CookieRememberMeManager manager = new CookieRememberMeManager();
+//// manager.setCipherKey(Base64.decode("Z3VucwAAAAAAAAAAAAAAAA=="));
+// manager.setCookie(rememberMeCookie);
+// return manager;
+// }
+//
+// /**
+// * 记住密码Cookie
+// */
+// @Bean
+// public SimpleCookie rememberMeCookie() {
+//// SimpleCookie simpleCookie = new SimpleCookie("rememberMe");
+// SimpleCookie simpleCookie = new SimpleCookie("");
+// simpleCookie.setHttpOnly(true);
+// simpleCookie.setMaxAge(7 * 24 * 60 * 60);//7天
+// return simpleCookie;
+// }
/**
* Shiro的过滤器链
@@ -153,7 +156,7 @@
* authc 需要认证
* user 验证通过或RememberMe登录的都可以
*
- * 当应用开启了rememberMe时,用户下次访问时可以是一个user,但不会是authc,因为authc是需要重新认证的
+ * 已关闭 RememberMe，/** 由 user 改为 authc，每次请求都需要重新登录态
*
* 顺序从上到下,优先级依次降低
*
@@ -176,7 +179,7 @@
hashMap.put("/global/sessionError", "anon");
hashMap.put("/kaptcha", "anon");
hashMap.put("/api/placeOrder/notifyUrl", "anon");
- hashMap.put("/**", "user");
+ hashMap.put("/**", "authc");
shiroFilter.setFilterChainDefinitionMap(hashMap);
diff --git a/UserQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/modular/system/controller/LoginController.java b/UserQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/modular/system/controller/LoginController.java
index f32483a..81a27a3 100644
--- a/UserQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/modular/system/controller/LoginController.java
+++ b/UserQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/modular/system/controller/LoginController.java
@@ -88,7 +88,6 @@
String username = super.getPara("username").trim();
String password = super.getPara("password").trim();
- String remember = super.getPara("remember");
//验证验证码是否正确
if (KaptchaUtil.getKaptchaOnOff()) {
@@ -101,12 +100,7 @@
Subject currentUser = ShiroKit.getSubject();
UsernamePasswordToken token = new UsernamePasswordToken(username, password.toCharArray());
-
- if ("on".equals(remember)) {
- token.setRememberMe(true);
- } else {
- token.setRememberMe(false);
- }
+ // RememberMe 已关闭，不再下发 rememberMe Cookie
currentUser.login(token);
diff --git a/UserQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/modular/system/util/zhenglian/ZhengLianConfig.java b/UserQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/modular/system/util/zhenglian/ZhengLianConfig.java
index 2e3b85a..0714add 100644
--- a/UserQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/modular/system/util/zhenglian/ZhengLianConfig.java
+++ b/UserQYTTravel/guns-admin/src/main/java/com/stylefeng/guns/modular/system/util/zhenglian/ZhengLianConfig.java
@@ -73,14 +73,14 @@
this.password = "111111";
}
if("prod".equals(activeProfile)){
- this.url = "https://gateway.zqpay.com";
- this.appid = "3e06da1751ec1626b30f7703a088f298";
- this.merchNo = "B00000402";
- this.encrpNo = "1342935640";
- this.signNo = "1471742568";
- this.cer = "/etraffic/server/1342935640.cer";
- this.sm2 = "/etraffic/server/1342935640.sm2";
- this.password = "31028Mky";
+ this.url = "https://gateway.zqpay.com";
+ this.appid = "3e06da1751ec1626b30f7703a088f298";
+ this.merchNo = "B00000402";
+ this.encrpNo = "1342935640";
+ this.signNo = "1565548800";
+ this.cer = "/etraffic/server/1342935640.cer";
+ this.sm2 = "/etraffic/server/1565548800.sm2";
+ this.password = "123456";
}
return this;
}
--
Gitblit v1.7.1