处理密码加密

Author: waylau

samples/blog-user/src/main/java/com/waylau/spring/boot/blog/controller/UserController.java

@@ -11,6 +11,8 @@
 import org.springframework.data.domain.Pageable;
 import org.springframework.http.ResponseEntity;
 import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.ui.Model;
 import org.springframework.web.bind.annotation.DeleteMapping;
 import org.springframework.web.bind.annotation.GetMapping;
@@ -89,6 +91,23 @@ public ResponseEntity<Response> create(User user, Long authorityId) {
 		List<Authority> authorities = new ArrayList<>();
 		authorities.add(authorityService.getAuthorityById(authorityId));
 		user.setAuthorities(authorities);
+		
+		if(user.getId() == null) {
+			user.setEncodePassword(user.getPassword()); // 加密密码
+		}else {
+			// 判断密码是否做了变更
+			User originalUser = userService.getUserById(user.getId());
+			String rawPassword = originalUser.getPassword();
+			PasswordEncoder  encoder = new BCryptPasswordEncoder();
+			String encodePasswd = encoder.encode(user.getPassword());
+			boolean isMatch = encoder.matches(rawPassword, encodePasswd);
+			if (!isMatch) {
+				user.setEncodePassword(user.getPassword());
+			}else {
+				user.setPassword(user.getPassword());
+			}
+		}
+		
 		try {
 			userService.saveUser(user);
 		}  catch (ConstraintViolationException e)  {

samples/blog-user/src/main/java/com/waylau/spring/boot/blog/controller/UserspaceController.java

@@ -7,6 +7,8 @@
 import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.security.core.userdetails.UserDetailsService;
+import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.stereotype.Controller;
 import org.springframework.ui.Model;
 import org.springframework.web.bind.annotation.GetMapping;
@@ -61,11 +63,20 @@ public ModelAndView profile(@PathVariable("username") String username, Model mod
 	@PreAuthorize("authentication.name.equals(#username)") 
 	public String saveProfile(@PathVariable("username") String username,User user) {
 		System.out.println("username" + username);
-		User oldUser = userService.getUserById(user.getId());
-		oldUser.setEmail(user.getEmail());
-		oldUser.setName(user.getName());
-		oldUser.setPassword(user.getPassword());
-		userService.saveUser(oldUser);
+		User originalUser = userService.getUserById(user.getId());
+		originalUser.setEmail(user.getEmail());
+		originalUser.setName(user.getName());
+		
+		// 判断密码是否做了变更
+		String rawPassword = originalUser.getPassword();
+		PasswordEncoder  encoder = new BCryptPasswordEncoder();
+		String encodePasswd = encoder.encode(user.getPassword());
+		boolean isMatch = encoder.matches(rawPassword, encodePasswd);
+		if (!isMatch) {
+			originalUser.setEncodePassword(user.getPassword());
+		}
+		
+		userService.saveUser(originalUser);
 		return "redirect:/u/" + username + "/profile";
 	}
 

samples/blog-user/src/main/java/com/waylau/spring/boot/blog/domain/User.java

@@ -128,11 +128,15 @@ public String getPassword() {
 	}
 
 	public void setPassword(String password) {
+		this.password = password;
+	}
+
+	public void setEncodePassword(String password) {
 		PasswordEncoder  encoder = new BCryptPasswordEncoder();
 		String encodePasswd = encoder.encode(password);
 		this.password = encodePasswd;
 	}
-
+	
 	@Override
 	public boolean isAccountNonExpired() {
 		return true;

samples/blog-user/src/main/resources/templates/profile.html

@@ -77,7 +77,7 @@ <h5 class="card-header"><i class="fa fa-cog" aria-hidden="true"></i> 个人设
 							</div>
 							<div class="form-group">
 								<label for="password" class="col-form-label">密码</label>
-								<input type="password" class="form-control" id="password" name="password"  th:value="*{password}" maxlength="30" placeholder="请输入密码，字母或特殊符号和数字结合" >
+								<input type="password" class="form-control" id="password" name="password"  th:value="*{password}" maxlength="30" placeholder="请输入密码，至少3个字符，至多30个" >
 							</div>
 							<div class="form-group">
 								<button type="submit" class="btn btn-primary">保存</button>