java SSH中防止非法登录过滤器的使用

//实体类

public class UserBean {
private int userid;
private String username;
private String password;

//get()和set()方法
}

//web.xml配置过滤器

//登录方法验证

import java.util.List;

import org.springframework.orm.hibernate3.support.HibernateDaoSupport;

public class UserManagerImplements extends HibernateDaoSupport implements
UserManagerInterface {

public boolean checkUser(String username, String password) {
boolean flag = false;
List list =getHibernateTemplate().find(
    "from UserBean where username=? and password=?",
    new String[]{username,password});
if (list.size() != 0) {
   flag = true;
}
return flag;
}

}

//登录过滤器编写
import user.UserManagerImplements;

import java.io.IOException;
import java.io.PrintWriter;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.RequestDispatcher;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

public class LoginFilter implements Filter {
private static final String LOGIN_URI="login_uri";
private static final String INDEX_URI="index_uri";
private String login_page;
private String index_page;
public void init(FilterConfig filterConfig) throws ServletException {
login_page=filterConfig.getInitParameter(LOGIN_URI);
index_page=filterConfig.getInitParameter(INDEX_URI);

if(null==login_page || null==index_page){
throw new ServletException("没有指定的登录页面或主页");
}
}
public void destroy() {
// TODO Auto-generated method stub

}
// private UserManagerInterface umi;
// public void setUmi(UserManagerInterface umi) {
// this.umi = umi;
// }
public void doFilter(ServletRequest request, ServletResponse response,
   FilterChain chain) throws IOException, ServletException {

HttpServletRequest httpReq=(HttpServletRequest)request;
HttpServletResponse httpResp=(HttpServletResponse)response;
HttpSession session=httpReq.getSession();
String request_uri=httpReq.getRequestURI();
String ctxpath=httpReq.getContextPath();
String uri=request_uri.substring(ctxpath.length());
//判断用户访问的是否是登录页面
if(login_page.equals(uri)){
   String strlogin=httpReq.getParameter("action");
   if("login".equals(strlogin)){
    //如果提交信息，则对用户进行验证
    String name=httpReq.getParameter("username").trim();
    String pwt=httpReq.getParameter("password").trim();
    if(new UserManagerImplements().checkUser(name,pwt)){
     session.setAttribute("islogin", "true");
     session.setAttribute("username", name);
     String origin_uri=httpReq.getParameter("origin_uri");
     if(null!=origin_uri && !"".equals(origin_uri)){
      httpResp.sendRedirect(origin_uri);
     }else{
      httpResp.sendRedirect(ctxpath+index_page);
      return;
     }
    }else{
     String origin_uri=httpReq.getParameter("origin_uri");
     if(null!=origin_uri && !"".equals(origin_uri)){
      httpReq.setAttribute("origin_uri", origin_uri);

     }
     httpResp.setContentType("text/html;charset=utf-8");
     PrintWriter out=httpResp.getWriter();
     out.print("<script language=javascript>alert('用户名或密码错误，请重新输入')</script>");
     RequestDispatcher rd=httpReq.getRequestDispatcher(login_page);
     rd.include(httpReq, httpResp);
     return;
    }
   }else{
    chain.doFilter(httpReq, httpResp);
    return;
   }
}else{
   String islogin=(String)session.getAttribute("islogin");
   if("true".equals(islogin)){
    chain.doFilter(httpReq, httpResp);
    return;
   }else{
    String strQuery=httpReq.getQueryString();
    if(null!=strQuery){
     request_uri=request_uri+"?"+strQuery;
    }
    httpReq.setAttribute("origin_uri", request_uri);
    RequestDispatcher rd=httpReq.getRequestDispatcher(login_page);
    rd.forward(httpReq, httpResp);
    return;
   }
}
}

}

本站仅提供存储服务，所有内容均由用户发布，如发现有害或侵权内容，请点击举报。