From 7e75fb3649ffc979794032b0566d22b9e2240c4a Mon Sep 17 00:00:00 2001
From: guo <guo@guo>
Date: Wed, 8 Nov 2023 10:11:54 +0800
Subject: [PATCH] =?UTF-8?q?MD5=E5=8A=A0=E5=AF=86+=E6=97=B6=E9=97=B4?=
 =?UTF-8?q?=E6=88=B3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../xmgl/modules/basicdata/controller/LoginController.java     | 2 ++
 .../modules/basicdata/service/impl/SystemUserServiceImpl.java  | 3 ++-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/main/java/com/zhgd/xmgl/modules/basicdata/controller/LoginController.java b/src/main/java/com/zhgd/xmgl/modules/basicdata/controller/LoginController.java
index 183e8a868..b3e41ac99 100644
--- a/src/main/java/com/zhgd/xmgl/modules/basicdata/controller/LoginController.java
+++ b/src/main/java/com/zhgd/xmgl/modules/basicdata/controller/LoginController.java
@@ -1,6 +1,7 @@
 package com.zhgd.xmgl.modules.basicdata.controller;
 
 
+import cn.hutool.crypto.SecureUtil;
 import com.baomidou.mybatisplus.core.toolkit.Wrappers;
 import com.zhgd.annotation.OperLog;
 import com.zhgd.jeecg.common.api.vo.Result;
@@ -80,6 +81,7 @@ public class LoginController {
     @ApiImplicitParams({
             @ApiImplicitParam(name = "account", required = true, value = "登录账号", paramType = "form"),
             @ApiImplicitParam(name = "md5Password", required = true, value = "账号md5密码登录", paramType = "form"),
+            @ApiImplicitParam(name = "timestamp", required = true, value = "时间戳", paramType = "form"),
     })
     @PostMapping(value = "/md5/login")
     public Result<Map<String, Object>> md5Login(@RequestBody Map<String, Object> map) {
diff --git a/src/main/java/com/zhgd/xmgl/modules/basicdata/service/impl/SystemUserServiceImpl.java b/src/main/java/com/zhgd/xmgl/modules/basicdata/service/impl/SystemUserServiceImpl.java
index 3e4e8e95d..450c815b0 100644
--- a/src/main/java/com/zhgd/xmgl/modules/basicdata/service/impl/SystemUserServiceImpl.java
+++ b/src/main/java/com/zhgd/xmgl/modules/basicdata/service/impl/SystemUserServiceImpl.java
@@ -1065,6 +1065,7 @@ public class SystemUserServiceImpl extends ServiceImpl<SystemUserMapper, SystemU
             SystemUser systemUser = systemUserMapper.selectOne(queryWrapper);
 
             String md5Password = MapUtils.getString(map, "md5Password");
+            String timestamp = MapUtils.getString(map, "timestamp");
 
             //登录失败次数不得多于5次，登录失败后锁定时间不少于10分钟
             String key = PW_FAILED_COUNT_PREFIX + EnvironmentUtil.getActiveEnvironment() + ":" + account;
@@ -1077,7 +1078,7 @@ public class SystemUserServiceImpl extends ServiceImpl<SystemUserMapper, SystemU
                 log.info("查询不到systemUser");
                 failedPrompt(key, num);
             } else {
-                if (!StringUtils.equalsIgnoreCase(SecureUtil.md5(systemUser.getShowPassword()), md5Password)) {
+                if (!StringUtils.equalsIgnoreCase(SecureUtil.md5(SecureUtil.md5(systemUser.getShowPassword()) + timestamp), md5Password)) {
                     log.info("密码不正确，原：{}，现：{}", md5Password, systemUser.getPassword());
                     failedPrompt(key, num);
                 }