From b17ea544cca5be26f5ba46bdf230f2b01ecf984c Mon Sep 17 00:00:00 2001
From: mzc5649 <13027087095@163.com>
Date: Thu, 15 Apr 2021 14:51:14 +0800
Subject: [PATCH] =?UTF-8?q?=E3=80=90add=E3=80=91=E6=B7=BB=E5=8A=A0?=
 =?UTF-8?q?=E7=94=A8=E6=88=B7=E7=99=BB=E5=BD=95=E6=97=B6=E7=9A=84=E7=AD=89?=
 =?UTF-8?q?=E4=BF=9D=E6=9C=BA=E5=88=B6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../system/controller/LoginController.java    | 30 ++++++++++++++++---
 1 file changed, 26 insertions(+), 4 deletions(-)

diff --git a/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/LoginController.java b/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/LoginController.java
index 60dc6d34..d38f03af 100644
--- a/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/LoginController.java
+++ b/jero-boot/jero-boot-module-system/src/main/java/com/jero/modules/system/controller/LoginController.java
@@ -60,7 +60,10 @@ public class LoginController {
 	private BaseCommonService baseCommonService;
 
 	private static final String BASE_CHECK_CODES = "qwertyuiplkjhgfdsazxcvbnmQWERTYUPLKJHGFDSAZXCVBNM1234567890";
-
+	//密码登录错误的次数前缀
+	public static final String RETRY_LOGIN_PREFIX = "login:retryLoginCount_";
+	//密码登录错误的最大限制次数
+	public static final int RETRY_LOGIN_MAX_COUNT = 5;
 	@ApiOperation("登录接口")
 	@RequestMapping(value = "/login", method = RequestMethod.POST)
 	public Result<JSONObject> login(@RequestBody SysLoginModel sysLoginModel){
@@ -98,15 +101,34 @@ public class LoginController {
 		if(!result.isSuccess()) {
 			return result;
 		}
-		
+
+		// 若用户名有效，则查询该账号的登陆失败次数是否符合等保要求
+		int retryCount = 0 ;
+		if ( redisUtil.get(RETRY_LOGIN_PREFIX + username) != null){
+			retryCount = (int) redisUtil.get(RETRY_LOGIN_PREFIX + username);
+		}
+		if (retryCount >= RETRY_LOGIN_MAX_COUNT){
+			result.error500("密码错误次数过多，请稍后重试");
+			return result;
+		}
 		//2. 校验用户名或密码是否正确
 		String userpassword = PasswordUtil.encrypt(username, password, sysUser.getSalt());
 		String syspassword = sysUser.getPassword();
 		if (!syspassword.equals(userpassword)) {
-			result.error500("用户名或密码错误");
+			// 重试登录次数加一
+			retryCount++;
+			if( retryCount == 1){
+				redisUtil.set(RETRY_LOGIN_PREFIX + username,retryCount, 1000 * 60 * 30);
+			}else {
+				redisUtil.set(RETRY_LOGIN_PREFIX + username,retryCount,redisUtil.getExpire(RETRY_LOGIN_PREFIX + username));
+			}
+			String msg = retryCount == RETRY_LOGIN_MAX_COUNT ? "密码错误次数过多，请稍后重试":"用户名或密码错误，剩余可登录次数:"+(RETRY_LOGIN_MAX_COUNT - retryCount);
+			result.error500(msg);
 			return result;
 		}
-				
+		//登录成功，清除错误登录次数
+		redisUtil.del(RETRY_LOGIN_PREFIX + username);
+
 		//用户登录信息
 		userInfo(sysUser, result);
 		//update-begin--Author:wangshuai  Date:20200714  for：登录日志没有记录人员