From 3015f968e3915f5a37d6453c460f385305a0a3b1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E9=82=A3=E4=BA=9B=E8=8A=B1=E5=84=BF?= <1156921458@qq.com>
Date: Fri, 20 Jun 2025 09:49:23 +0800
Subject: [PATCH] ..

---
 .../com/budwk/app/sys/controller/SysLoginController.java    | 2 +-
 .../com/budwk/app/sys/services/impl/SysUserServiceImpl.java | 6 ++++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/main/java/com/budwk/app/sys/controller/SysLoginController.java b/src/main/java/com/budwk/app/sys/controller/SysLoginController.java
index e3be256..929333f 100644
--- a/src/main/java/com/budwk/app/sys/controller/SysLoginController.java
+++ b/src/main/java/com/budwk/app/sys/controller/SysLoginController.java
@@ -90,7 +90,7 @@ public class SysLoginController {
                           HttpServletRequest req, HttpServletResponse response, HttpSession session) {
         try {
             Sys_user user = null;
-            sysUserService.checkLoginname(username);
+//            sysUserService.checkLoginname(username);
             validateService.checkCode(captchaKey, captchaCode);
             user = sysUserService.loginByPassword(username, password);
             if (user == null) {
diff --git a/src/main/java/com/budwk/app/sys/services/impl/SysUserServiceImpl.java b/src/main/java/com/budwk/app/sys/services/impl/SysUserServiceImpl.java
index d086283..99914d4 100644
--- a/src/main/java/com/budwk/app/sys/services/impl/SysUserServiceImpl.java
+++ b/src/main/java/com/budwk/app/sys/services/impl/SysUserServiceImpl.java
@@ -298,7 +298,9 @@ public class SysUserServiceImpl extends BaseServiceImpl<Sys_user> implements Sys
     public Sys_user loginByPassword(String loginname, String passowrd) throws BaseException {
         Sys_user user = this.fetch(Cnd.where("loginname", "=", loginname));
         if (user == null) {
-            throw new BaseException("用户不存在");
+            // throw new BaseException("用户不存在");
+            // 防止暴力破解
+            throw new BaseException("用户名或者密码不正确");
         }
         if (user.isDisabled()) {
             throw new BaseException("用户被禁用");
@@ -307,7 +309,7 @@ public class SysUserServiceImpl extends BaseServiceImpl<Sys_user> implements Sys
         String decodePwd = Base64Decoder.decodeStr(passowrd);
         String hashedPassword = PwdUtil.getPassword(decodePwd, user.getSalt());
         if (!Strings.sNull(hashedPassword).equalsIgnoreCase(user.getPassword())) {
-//            throw new BaseException("密码不正确");
+            throw new BaseException("用户名或者密码不正确");
         }
         user = this.fetchLinks(user, "unit");
         if (Lang.isNotEmpty(user.getUnit()) && StrUtil.isNotBlank(user.getUnit().getUnionId())) {