diff --git a/src/main/java/com/budwk/app/sys/controller/SysUserController.java b/src/main/java/com/budwk/app/sys/controller/SysUserController.java
index 4145ff2..179a9b6 100644
--- a/src/main/java/com/budwk/app/sys/controller/SysUserController.java
+++ b/src/main/java/com/budwk/app/sys/controller/SysUserController.java
@@ -69,12 +69,12 @@ public class SysUserController {
                     return Result.error("用户名已存在!");
                 }
             }
-            if (!ReUtil.isMatch("^[a-zA-Z0-9][a-zA-Z0-9]{1,19}$", user.getLoginname())) {
-                return Result.error("用户名只能是字母和数字,且长度在2-20之间!");
+            if (!ReUtil.isMatch("^(?=.*[a-z])(?=.*[A-Z])(?=.*\\\\d)(?=.*[!@#$%^&*()\\\\-_=+{};:,<.>]).{8,20}$", user.getLoginname())) {
+                return Result.error("密码必须包含大小写字母、数字和特殊符号，且长度在8-20位之间！");
             }
 
-            if (!ReUtil.isMatch("^(?=.*[a-z])(?=.*[A-Z])(?=.*\\d)[A-Za-z\\d]{8,20}$", user.getPassword())) {
-                return Result.error("密码必须包含大写字母、小写字母和数字，并且长度在8-20之间!");
+            if (!ReUtil.isMatch("^(?=.*[a-z])(?=.*[A-Z])(?=.*\\\\d)(?=.*[!@#$%^&*()\\\\-_=+{};:,<.>]).{8,20}$", user.getPassword())) {
+                return Result.error("密码必须包含大小写字母、数字和特殊符号，且长度在8-20位之间！");
             }
 
             String salt = R.UU32();
diff --git a/src/main/java/com/budwk/app/sys/models/Sys_user.java b/src/main/java/com/budwk/app/sys/models/Sys_user.java
index 59cce12..ee1bb78 100644
--- a/src/main/java/com/budwk/app/sys/models/Sys_user.java
+++ b/src/main/java/com/budwk/app/sys/models/Sys_user.java
@@ -329,6 +329,6 @@ public class Sys_user extends BaseModel implements Serializable {
     @Comment("是否禁用")
     @Default(value = "0")
     @ColDefine(type = ColType.BOOLEAN)
-    private Boolean disabled;
+    private boolean disabled;
 
 }
diff --git a/src/main/java/com/budwk/app/sys/services/SysUserService.java b/src/main/java/com/budwk/app/sys/services/SysUserService.java
index a3aff10..29e6fdc 100644
--- a/src/main/java/com/budwk/app/sys/services/SysUserService.java
+++ b/src/main/java/com/budwk/app/sys/services/SysUserService.java
@@ -154,6 +154,15 @@ public interface SysUserService extends BaseService<Sys_user> {
      */
     Sys_user loginByLoginName(String loginname);
 
+    /**
+     * 通过用户名获取用户信息
+     *
+     * @param loginname 用户名
+     * @return
+     * @throws BaseException
+     */
+    Sys_user getUserByLoginname(String loginname) throws BaseException;
+
     /**
      * 通过用户ID获取用户信息
      *
diff --git a/src/main/java/com/budwk/app/sys/services/impl/SysUserServiceImpl.java b/src/main/java/com/budwk/app/sys/services/impl/SysUserServiceImpl.java
index d96eb29..9afa1aa 100644
--- a/src/main/java/com/budwk/app/sys/services/impl/SysUserServiceImpl.java
+++ b/src/main/java/com/budwk/app/sys/services/impl/SysUserServiceImpl.java
@@ -300,6 +300,9 @@ public class SysUserServiceImpl extends BaseServiceImpl<Sys_user> implements Sys
         if (user == null) {
             throw new BaseException("用户不存在");
         }
+        if (user.isDisabled()) {
+            throw new BaseException("用户被禁用");
+        }
         // base64解码密码
         String decodePwd = Base64Decoder.decodeStr(passowrd);
         String hashedPassword = PwdUtil.getPassword(decodePwd, user.getSalt());
@@ -339,6 +342,7 @@ public class SysUserServiceImpl extends BaseServiceImpl<Sys_user> implements Sys
     }
 
     // 这里不能用缓存,因为没有 userId 没法用前缀清除,会造成缓存清除不干净
+    @Override
     public Sys_user getUserByLoginname(String loginname) throws BaseException {
         Sys_user user = this.fetch(Cnd.where("loginname", "=", loginname));
         if (user == null) {
diff --git a/src/main/java/com/budwk/app/web/commons/proc/XssSqlFilterProcessor.java b/src/main/java/com/budwk/app/web/commons/proc/XssSqlFilterProcessor.java
index 009b59f..11d6782 100644
--- a/src/main/java/com/budwk/app/web/commons/proc/XssSqlFilterProcessor.java
+++ b/src/main/java/com/budwk/app/web/commons/proc/XssSqlFilterProcessor.java
@@ -22,7 +22,6 @@ import java.util.regex.Pattern;
 
 /**
  * SQL XSS拦截
- * Created by wizzer on 2016/7/1.
  */
 public class XssSqlFilterProcessor extends AbstractProcessor {
 
diff --git a/src/main/resources/views/platform/sys/user/index.html b/src/main/resources/views/platform/sys/user/index.html
index f2000d1..164d8dd 100644
--- a/src/main/resources/views/platform/sys/user/index.html
+++ b/src/main/resources/views/platform/sys/user/index.html
@@ -40,18 +40,18 @@ layout("/layouts/platform.html"){
             <el-table-column prop="username" label="姓名" header-align="center" :show-overflow-tooltip="true"></el-table-column>
             <el-table-column prop="sex" label="性别" header-align="center" :show-overflow-tooltip="true"></el-table-column>
             <el-table-column prop="unitName" label="所属单位" header-align="center" align="center" :show-overflow-tooltip="true"></el-table-column>
-<!--            <el-table-column sortable prop="disabled" label="帐号状态" header-align="center" align="center" :show-overflow-tooltip="true">-->
-<!--                <template slot-scope="scope">-->
-<!--                    <i v-if="scope.row.disabled" class="fa fa-circle text-danger ml5"></i>-->
-<!--                    <i v-if="!scope.row.disabled" class="fa fa-circle text-success ml5"></i>-->
-<!--                </template>-->
-<!--            </el-table-column>-->
-<!--            <el-table-column sortable prop="userOnline" label="在线状态" header-align="center" align="center" :show-overflow-tooltip="true">-->
-<!--                <template slot-scope="scope">-->
-<!--                    <i v-if="scope.row.userOnline" class="text-success ml5">在线</i>-->
-<!--                    <i v-if="!scope.row.userOnline" class="text-danger ml5">离线</i>-->
-<!--                </template>-->
-<!--            </el-table-column>-->
+            <!--            <el-table-column sortable prop="disabled" label="帐号状态" header-align="center" align="center" :show-overflow-tooltip="true">-->
+            <!--                <template slot-scope="scope">-->
+            <!--                    <i v-if="scope.row.disabled" class="fa fa-circle text-danger ml5"></i>-->
+            <!--                    <i v-if="!scope.row.disabled" class="fa fa-circle text-success ml5"></i>-->
+            <!--                </template>-->
+            <!--            </el-table-column>-->
+            <!--            <el-table-column sortable prop="userOnline" label="在线状态" header-align="center" align="center" :show-overflow-tooltip="true">-->
+            <!--                <template slot-scope="scope">-->
+            <!--                    <i v-if="scope.row.userOnline" class="text-success ml5">在线</i>-->
+            <!--                    <i v-if="!scope.row.userOnline" class="text-danger ml5">离线</i>-->
+            <!--                </template>-->
+            <!--            </el-table-column>-->
             <el-table-column prop="userOnline" label="操作" width="120">
                 <template slot-scope="scope">
                     <el-dropdown @command="dropdownCommand">
@@ -249,17 +249,17 @@ layout("/layouts/platform.html"){
                     password: [
                         { required: true, message: "请输入密码", trigger: "blur" },
                         {
-                            pattern: /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)[\S]{8,20}$/,
-                            message: "密码必须8位及以上且包含大写字母、小写字母和数字",
+                            pattern: /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[!@#$%^&*()\-_=+{}[\]|;:'",.<>/?]).{8,20}$/,
+                            message: "密码必须同时包含大小写字母、数字、特殊符号，且长度在8到20位之间",
                             trigger: "change"
                         },
-                        { min: 3, max: 20, message: "密码长度必须是3-20位", trigger: "change" }
+                        { min: 8, max: 20, message: "密码长度必须是8-20位", trigger: "change" }
                     ],
                     passwordAgain: [
                         { required: true, message: "请再次输入新密码", trigger: "blur" },
                         {
-                            pattern: /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)[\S]{8,20}$/,
-                            message: "密码必须包含大写字母、小写字母和数字，并且长度在8-20之间",
+                            pattern: /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[!@#$%^&*()\-_=+{}[\]|;:'",.<>/?]).{8,20}$/,
+                            message: "密码必须同时包含大小写字母、数字、特殊符号，且长度在8到20位之间",
                             trigger: "change"
                         },
                         { validator: validatePass, trigger: "change" }