CMS小项目02---Spring+SpringMVC+Mybatis+shiro框架搭建

﹏ヽ暗。殇╰゛Y 2022-05-31 10:41 257阅读 0赞

*  整体框架还是选用Spring+SpringMVC+MyBatis
 *  连接池选用阿里巴巴的Druid
 *  项目管理使用的是Maven
 *  日志管理log4j
 *  安全框架使用Shiro
 *  页面模板引擎常用的FreeMarker  
    （这个以前没用过，研究了不少时间）
 *  前台JavaScript+JQ+各类插件
 *  数据库MySql  
    \-

SSM框架的组装以前写过一个，这一篇就只是贴上大致的配置文件

# 1.配置文件 #

我们设为三类：  
web.xml  
框架xml  
properties配置文件

### 1.web.xml ###

<?xml version="1.0" encoding="UTF-8"?>    
    <web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" version="3.0">    
        <display-name>CMS About</display-name>    
    
        <welcome-file-list>    
            <welcome-file>/index.jsp</welcome-file>    
        </welcome-file-list>    
    
            
        <context-param>    
             <param-name>contextConfigLocation</param-name>    
            <param-value>classpath:applicationContext.xml</param-value>    
        </context-param>    
        <listener>    
            <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>    
        </listener>    
    
            
        <filter>    
            <filter-name>encodingFilter</filter-name>    
            <filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>    
            <async-supported>true</async-supported>    
            <init-param>    
                <param-name>encoding</param-name>    
                <param-value>UTF-8</param-value>    
            </init-param>    
        </filter>    
        <filter-mapping>    
            <filter-name>encodingFilter</filter-name>    
            <url-pattern>/*</url-pattern>    
        </filter-mapping>    
        
        <filter>
            <filter-name>shiroFilter</filter-name>
            <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
            <async-supported>true</async-supported>
            <init-param>
                <param-name>targetFilterLifecycle</param-name>
                <param-value>true</param-value>
            </init-param>
        </filter>
    
        <filter-mapping>
            <filter-name>shiroFilter</filter-name>
            <url-pattern>/cms/*</url-pattern>
            <dispatcher>REQUEST</dispatcher>
        </filter-mapping>
          
         <filter>
            <filter-name>DruidWebStatFilter</filter-name>
            <filter-class>com.alibaba.druid.support.http.WebStatFilter</filter-class>
            <init-param>
                <param-name>exclusions</param-name>
                <param-value>*. js ,*. gif ,*. jpg ,*. png ,*. css ,*. ico ,/ druid /*</param-value>
            </init-param>
         </filter>
         <filter-mapping>
            <filter-name>DruidWebStatFilter</filter-name>
            <url-pattern>/*</url-pattern>
         </filter-mapping>
    
         <servlet>
            <servlet-name>DruidStatView</servlet-name>
            <servlet-class>com.alibaba.druid.support.http.WebStatFilter</servlet-class>
         </servlet>
         <servlet-mapping>
            <servlet-name>DruidStatView</servlet-name>
            <url-pattern>/druid/*</url-pattern>
         </servlet-mapping>
            
        <servlet>    
            <servlet-name>SpringMVC</servlet-name>    
            <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>    
            <init-param>    
                <param-name>contextConfigLocation</param-name>    
                <param-value>classpath:spring-mvc.xml</param-value>    
            </init-param>    
            <load-on-startup>1</load-on-startup>    
            <async-supported>true</async-supported>    
        </servlet>    
        <servlet-mapping>    
            <servlet-name>SpringMVC</servlet-name>    
            <url-pattern>/cms/*</url-pattern>    
        </servlet-mapping>    
    
    </web-app>

### 2.ApplicationContext ###

这个是主要的引导文件，用于引入其他的配置文件

### 3.spring-dao ###

dao接口配置文件，用于指定扫描的Dao所在的类以及SqlSessionFactory

### 4.spring-db.xml ###

配置连接池的参数，注意，这里是引入jdbc.properties的信息。

<?xml version="1.0" encoding="UTF-8"?>    
    <beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:p="http://www.springframework.org/schema/p" xmlns:context="http://www.springframework.org/schema/context" xmlns:mvc="http://www.springframework.org/schema/mvc" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.1.xsd http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-4.0.xsd">    
    
            
        <bean id="propertyConfigurer" class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer">    
            <property name="location" value="classpath:jdbc.properties" />    
        </bean>    
    
        <bean id="dataSource" class="com.alibaba.druid.pool.DruidDataSource" destroy-method="close">    
            <property name="driverClassName" value="${driver}" />    
            <property name="url" value="${url}" />    
            <property name="username" value="${username}" />    
            <property name="password" value="${password}" />    
                
            <property name="initialSize" value="${initialSize}"></property>    
                
            <property name="maxActive" value="${maxActive}"></property>    
                
            <property name="maxIdle" value="${maxIdle}"></property>    
                
            <property name="minIdle" value="${minIdle}"></property>    
                
            <property name="maxWait" value="${maxWait}"></property>    
        </bean>    
    
            
        <bean id="sqlSessionFactory" class="org.mybatis.spring.SqlSessionFactoryBean">    
            <property name="dataSource" ref="dataSource" />    
                
            <property name="mapperLocations" value="classpath:com/cms/dao/mapper/*.xml"></property>    
        </bean>    
    
    </beans>

*  jdbc.properties

driver=com.mysql.jdbc.Driver
    url=jdbc\:mysql\://127.0.0.1\:3306/cms
    username=root
    password=123456
    #\u5B9A\u4E49\u521D\u59CB\u8FDE\u63A5\u6570    
    initialSize=0
    #\u5B9A\u4E49\u6700\u5927\u8FDE\u63A5\u6570    
    maxActive=20
    #\u5B9A\u4E49\u6700\u5927\u7A7A\u95F2    
    maxIdle=20
    #\u5B9A\u4E49\u6700\u5C0F\u7A7A\u95F2    
    minIdle=1
    #\u5B9A\u4E49\u6700\u957F\u7B49\u5F85\u65F6\u95F4    
    maxWait=60000

### 5.spring-tx.xml ###

事务管理有关配置文件

### 6.spring-shiro.xml ###

这个是shiro最简单的一种

<?xml version="1.0" encoding="UTF-8"?>
    <beans xmlns="http://www.springframework.org/schema/beans" xmlns:mvc="http://www.springframework.org/schema/mvc" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:context="http://www.springframework.org/schema/context" xsi:schemaLocation=" http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.2.xsd http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.2.xsd http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd">
    
        <description>Shiro安全配置</description>
        
        <context:component-scan base-package="com.cms.service" use-default-filters="false">
            <context:include-filter type="annotation" expression="org.springframework.stereotype.Service"/>
        </context:component-scan>
    
    
        
        <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
            
               <property name="realm" ref="UserRealm" />
           <property name="cacheManager" ref="shiroEhcacheManager" />
        </bean>
    
    
        
        <bean id="UserRealm" class="com.cms.shiro.UserRealm" />
    
        
    
                    
    
    
        
        <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <property name="securityManager" ref="securityManager" />
         
         <property name="loginUrl" value="/index.jsp" /> 
         <property name="successUrl" value="/WEB-INF/static/cms/index.jsp" />
         <property name="unauthorizedUrl" value="/login/unauthorized" />
            <property name="filterChainDefinitions">
                <value>
                    /cms/login=anon
                    /cms/register=anon
                    /cms/logining=anon
                    /cms/main/**=authc
                </value>
            </property>
        </bean>
        
        <bean id="shiroEhcacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">
            <property name="cacheManagerConfigFile" value="classpath:ehcache-shiro.xml"/>
        </bean>
        
        <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>
    </beans>

*  shiro-ehcache.properties

<?xml version="1.0" encoding="UTF-8"?>
    <ehcache xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="http://ehcache.org/ehcache.xsd">
        <diskStore path="java.io.tmpdir"/>
        <defaultCache maxElementsInMemory="10000" eternal="false" timeToIdleSeconds="900" timeToLiveSeconds="1800" overflowToDisk="false" memoryStoreEvictionPolicy="LFU" />
        <cache name="testEhcache" maxElementsInMemory="10000" eternal="false" overflowToDisk="false" timeToIdleSeconds="900" timeToLiveSeconds="1800" memoryStoreEvictionPolicy="LFU" />
    
    </ehcache>

### 7.spring-mvc配置文件 ###

MVC配置文件，包括添加扫描注解，视图设置，文件上传设置。

<?xml version="1.0" encoding="UTF-8"?>    
    <beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:p="http://www.springframework.org/schema/p" xmlns:context="http://www.springframework.org/schema/context" xmlns:mvc="http://www.springframework.org/schema/mvc" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.1.xsd http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-4.0.xsd">    
    
            
        <bean id="mappingJacksonHttpMessageConverter" class="org.springframework.http.converter.json.MappingJacksonHttpMessageConverter">    
            <property name="supportedMediaTypes">    
                <list>    
                    <value>text/html;charset=UTF-8</value>    
                </list>    
            </property>    
        </bean>    
    
               
        <mvc:annotation-driven />    
        <mvc:default-servlet-handler/>    
    
            
        <context:component-scan base-package="com.cms.controller" />    
    
            
        <bean class="org.springframework.web.servlet.mvc.annotation.AnnotationMethodHandlerAdapter">    
            <property name="messageConverters">    
                <list>    
                    <ref bean="mappingJacksonHttpMessageConverter" />     
                </list>    
            </property>    
        </bean>    
    
            
        <bean class="org.springframework.web.servlet.view.InternalResourceViewResolver">    
                
            <property name="prefix" value="/WEB-INF/static/cms/" />    
            <property name="suffix" value=".jsp" />    
        </bean>    
    
            
        <bean id="multipartResolver" class="org.springframework.web.multipart.commons.CommonsMultipartResolver">      
                
            <property name="defaultEncoding" value="utf-8" />      
                
            <property name="maxUploadSize" value="10485760000" />      
                
            <property name="maxInMemorySize" value="40960" />      
        </bean>     
    
    </beans>

# 2.Java代码 #

先贴出来，后面再一个个的来分析

### 1.首先，从登陆前台来看： ###

1.form表单提交，地址/CMS/cms/logining ,method是post

<%@ page language="java" import="java.util.*" pageEncoding="utf-8"%>
    <% String path = request.getContextPath(); String basePath = request.getScheme()+"://"+request.getServerName()+":"+request.getServerPort()+path+"/"; %>
    <%@ include file="/common/global.jsp" %>
    <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
    <html xmlns="http//www.w3.org/1999/xhtml">
    <head>
    <meta http-equiv="Content-Type" content="text/html; charset=gb2312" />
        <title>CMS</title>
    <link rel="stylesheet" type="text/css" href="${ctxPath}/css/login.css">
    </head>
    <body style="background:#000;">
      <div class="png login_logo"><img src="${ctxPath}/images/login.jpg" alt=""></div>
      <div class="login">
      <form action="/CMS/cms/logining" method="post" class="loginAction" id="loginAction">
        <div class="login_1"><input id="name" name="name" type="name" /></div>
        <div class="login_2"><input id="password" name="password" type="password" /></div>
        <div class="login_3"><input name="" type="checkbox" value="" /></div>
        <div class="register"><a href="${ctxPath}/cms/register" style="color: wheat;text-decoration: none;">我要注册</a></div>
        <div class="login_4 png"><a href="javascript:submit();"><img src="${ctxPath}/images/login_08.jpg" /></a></div>
      </form>
    
      </div>
    </body>
    </html>
    <script> function submit(){ if (document.getElementById("name").value == "") { alert("请输入姓名!"); document.getElementById("name").focus(); return false; } else if (document.getElementById("password").value == "") { alert("请输入密码"); document.getElementById("password").focus(); return false; } document.getElementById("loginAction").submit(); } </script>

### 2.被后台接收，Controller ###

1.因为地址为logging,所以映射到  
@RequestMapping(“/logining”)  
public ModelAndView logining（）

方法

package com.cms.controller;
    
    import javax.annotation.Resource;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    
    import org.apache.shiro.SecurityUtils;
    import org.apache.shiro.authc.AuthenticationException;
    import org.apache.shiro.authc.IncorrectCredentialsException;
    import org.apache.shiro.authc.UnknownAccountException;
    import org.apache.shiro.authc.UsernamePasswordToken;
    import org.apache.shiro.subject.Subject;
    import org.springframework.stereotype.Controller;
    import org.springframework.web.bind.annotation.RequestMapping;
    import org.springframework.web.servlet.ModelAndView;
    
    import com.cms.entity.User;
    import com.cms.service.LoginService;
    import com.cms.service.UserService;
    
    /** *@author:gang *@version: **/
    @Controller
    public class loginController {
        @RequestMapping("/login")
        public ModelAndView login(){
            ModelAndView mView = new ModelAndView();
            mView.setViewName("login");
            return mView;
        }
    
    
    //  测试String直接接收前台数据
    //  public void test(HttpServletRequest request,
    //          HttpServletResponse response, String username, String password){
    //      System.out.println(username);
    //      System.out.println(password);
    //      ModelAndView mView = new ModelAndView();
    //      mView.setViewName("main");
    //  }
        /*此处可能会有疑问，感觉shiro的realm完全没有用上，这个是因为我们将shiro交给spring容器控制了，看shiro的配置文件我们就可以发现adminRealm确实被使用了*/
        @Resource
        private UserService userService;
        @Resource
        private LoginService loginService;
    
        @RequestMapping("/logining")
        public ModelAndView logining(HttpServletRequest request,
                HttpServletResponse response, String name, String password) {
            ModelAndView mv = new ModelAndView();
            User user = userService.getUserByName(name);
            password = userService.getPasswordByUtil(user,password);
            UsernamePasswordToken token = new UsernamePasswordToken(name,
                    password);
            // 记录该令牌
            token.setRememberMe(false);
            // subject权限对象 
            Subject subject = SecurityUtils.getSubject();
            System.out.println(subject.isAuthenticated());
            String exceptionClassName = (String) request
                    .getAttribute("shiroLoginFailure");
            //判断是否已登录
            if (subject.isAuthenticated()){
                subject.logout();
            }
            try {
                // 提交申请，验证能不能通过，也回调reaml里的doGetAuthenticationInfo验证是否通过
                subject.login(token);
                System.out.println(exceptionClassName);
            } catch (UnknownAccountException ex) {// 用户名没有找到
                mv.addObject("msg", "用户未找到");
    //          ex.printStackTrace();
            } catch (IncorrectCredentialsException ex) {// 用户名密码不匹配
                mv.addObject("msg", "密码不正确");
    //          map.put("msg", "密码不正确");
    //          ex.printStackTrace();
            } catch (AuthenticationException e) {// 其他的登录错误
                mv.addObject("msg", "其他错误");
    //          e.printStackTrace();
            } catch (Exception e) {
                mv.addObject("msg", "登录异常");
    //          e.printStackTrace();
            }
    
            // 验证是否成功登录的方法
            if (subject.isAuthenticated()) {
                mv.setViewName("main");
            }else{
    //          mv.setViewName("redirect:/login.jsp");
                mv.setViewName("login"); //此处偷懒，一般是ajax请求，或重定向时将失败传回
                loginService.setSessionKey(request, user);
            }
    //      return new ModelAndView("redirect:/login.jsp");
            return mv;
        }
    
        // 退出
        @RequestMapping("/logout")
        public void logout() {
            Subject subject = SecurityUtils.getSubject();
            subject.logout();
        }
        @RequestMapping("/register")
        public ModelAndView register(){
            ModelAndView regView = new ModelAndView();
            regView.setViewName("register");
            return regView;
        }
    }

### 3.走到UserRealm验证 ###

核心：  
UsernamePasswordToken usernamePasswordToke = (UsernamePasswordToken)token;  
String account = usernamePasswordToke.getUsername();  
String pwd = String.valueOf(usernamePasswordToke.getPassword());  
User user = this.userService.getUserByName(account);  
。。。。。。。  
if( !user.getUserPassword().equals(pwd))\{  
throw new IncorrectCredentialsException();  
\}  
此处的user.getUserPassword()获取的是数据库的密码，这个我们进行过HASH加密，所以需要对输入的密码进行相同的加密（配合salt）  
调用UserService

package com.cms.shiro;
    
    import org.apache.shiro.authc.AuthenticationException;
    import org.apache.shiro.authc.AuthenticationInfo;
    import org.apache.shiro.authc.AuthenticationToken;
    import org.apache.shiro.authc.IncorrectCredentialsException;
    import org.apache.shiro.authc.SimpleAuthenticationInfo;
    import org.apache.shiro.authc.UnknownAccountException;
    import org.apache.shiro.authc.UsernamePasswordToken;
    import org.apache.shiro.authz.AuthorizationInfo;
    import org.apache.shiro.authz.SimpleAuthorizationInfo;
    import org.apache.shiro.realm.AuthorizingRealm;
    import org.apache.shiro.subject.PrincipalCollection;
    import org.springframework.beans.factory.annotation.Autowired;
    
    import com.cms.entity.User;
    import com.cms.service.UserService;
    
    
    /** *@author:gang *@version: **/
    public class UserRealm extends AuthorizingRealm{ 
    
        @Autowired
        private UserService userService;
    
        /** * 授权 * <p>Title: doGetAuthorizationInfo</p> * <p>Description: </p> * @param principals * @return * @see org.apache.shiro.realm.AuthorizingRealm#doGetAuthorizationInfo(org.apache.shiro.subject.PrincipalCollection) */
    
        @Override
        protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
            SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();//未进行授权处理
            return authorizationInfo;
        }
    
        /** * 认证 * <p>Title: doGetAuthenticationInfo</p> * <p>Description: </p> * @param token * @return * @throws AuthenticationException * @see org.apache.shiro.realm.AuthenticatingRealm#doGetAuthenticationInfo(org.apache.shiro.authc.AuthenticationToken) */
    
        @Override
        protected AuthenticationInfo doGetAuthenticationInfo(
                AuthenticationToken token) throws AuthenticationException {
            UsernamePasswordToken usernamePasswordToke = (UsernamePasswordToken)token; 
            String account = usernamePasswordToke.getUsername();
            String pwd = String.valueOf(usernamePasswordToke.getPassword());
            User user = this.userService.getUserByName(account);
            if( user == null ){
                throw new UnknownAccountException();
            }
            if( !user.getUserPassword().equals(pwd)){
                throw new IncorrectCredentialsException();
            }
    // if(Boolean.TRUE.equals( user.getLocked())){ 
    // throw new LockedAccountException(); //帐号锁定
    // }
            SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(
                    account,pwd,this.getName()); //此处未进行密码加密处理
            return authenticationInfo;
        }
    
            @Override
            public void clearCachedAuthorizationInfo(PrincipalCollection principals) {
                super.clearCachedAuthorizationInfo(principals);
            }
    
            @Override
            public void clearCachedAuthenticationInfo(PrincipalCollection principals) {
                super.clearCachedAuthenticationInfo(principals);
            }
    
            @Override
            public void clearCache(PrincipalCollection principals) {
                super.clearCache(principals);
            }
    
            public void clearAllCachedAuthorizationInfo() {
                getAuthorizationCache().clear();
            }
    
            public void clearAllCachedAuthenticationInfo() {
                getAuthenticationCache().clear();
            }
    
            public void clearAllCache() {
                clearAllCachedAuthenticationInfo();
                clearAllCachedAuthorizationInfo();
            }
    
    }

### 4.UserRealm调用UserService ###

通过以下方法获取加密后的密码  
public String getPasswordByUtil(User user,String password)

package com.cms.service;
    
    
    
    import java.util.Date;
    
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.stereotype.Service;
    
    import com.cms.dao.UserDao;
    import com.cms.entity.User;
    import com.cms.util.PasswordUtil;
    
    /** *@author:gang *@version: **/
    @Service
    public class UserService { 
    
        @Autowired
        private UserDao userDao;
    
        @Autowired
        private PasswordUtil passwordUtil;
    
        public User addUser(String name,String password,String email,String country){
            User user = new User();
            user.setUserPassword(password);
            user.setUserName(name);
            user.setCountry(country);
            user.setEmail(email);
            Date date = new Date();
            user.setDate(date);
            passwordUtil.encryptPassword(user);
            userDao.addUser(user);
            return user;
        }
    
        public User getUserByName(String name) {
            // TODO Auto-generated method stub
            User user = new User();
            user = userDao.getUserByName(name);
            return user;
        }
    
        public String getPasswordByUtil(User user,String password){
            String hashPassword = passwordUtil.returnPassword(user,password);
            return hashPassword;
        } 
    
    
    }

*  实体类user
 *  可以看到这里有一个salt,这个是加密时用到的

package com.cms.entity;
    
    import java.util.Date;
    
    /** *@author:gang *@version: **/
    public class User { 
        private String salt;
        private String name;
        private String password;
        private int Uid;
        private Date createTime;
        private String email;
        private String country;
        public String getEmail() {
            return email;
        }
    
        public void setEmail(String email) {
            this.email = email;
        }
    
        public String getCountry() {
            return country;
        }
    
        public void setCountry(String country) {
            this.country = country;
        }
    
        public String getUserName() {
            return name;
        }
    
        public void setUserName(String userName) {
            this.name = userName;
        }
    
        public String getUserPassword() {
            return password;
        }
    
        public void setUserPassword(String userPassword) {
            this.password = userPassword;
        }
    
        public int getUid() {
            return Uid;
        }
    
        public void setUid(int uid) {
            Uid = uid;
        }
    
        public Date getDate() {
            return createTime;
        }
    
        public void setDate(Date date) {
            this.createTime = date;
        }
    
        public String getSalt() {
            return salt;
        }
    
        public void setSalt(String hex) {
            // TODO Auto-generated method stub
            this.salt = hex;
        }
    
    
    }

*  PasswordUtil.java
 *  可以看到salt是在这里被设置的
 *  user.setSalt(randomNumberGenerator.nextBytes().toHex());

package com.cms.util;
    
    
    import org.apache.commons.codec.digest.DigestUtils;
    import org.apache.shiro.crypto.RandomNumberGenerator;
    import org.apache.shiro.crypto.SecureRandomNumberGenerator;
    import org.apache.shiro.crypto.hash.SimpleHash;
    import org.apache.shiro.util.ByteSource;
    import org.springframework.stereotype.Component;
    
    import com.cms.entity.User;
    
    /** *@author:gang *@version: **/
    @Component
    public class PasswordUtil { 
        //简单MD5加密
        public static String  getPassword(String password){
       return DigestUtils.md2Hex(password);}
    
        //
        private RandomNumberGenerator randomNumberGenerator = new SecureRandomNumberGenerator();
        private String algorithmName = "md5";
        private final int hashIterations = 2;
    
        public void encryptPassword(User user) {
            // User对象包含最基本的字段Username和Password
            user.setSalt(randomNumberGenerator.nextBytes().toHex());
             // 将用户的注册密码经过散列算法替换成一个不可逆的新密码保存进数据，散列过程使用了盐
            String newPassword = new SimpleHash(algorithmName, user.getUserPassword(),ByteSource.Util.bytes(user.getSalt()), hashIterations).toHex();
            user.setUserPassword(newPassword);
        }
        //
        public String returnPassword(User user,String password) {
             // 将用户的注册密码经过散列算法替换成一个不可逆的新密码保存进数据，散列过程使用了盐
            String newPassword = new SimpleHash(algorithmName, password,ByteSource.Util.bytes(user.getSalt()), hashIterations).toHex();
            return newPassword;
        }
    
    }

最后完成在前面对比完成，用户登录  
此时根据前面的设置跳转到登录界面、

// 验证是否成功登录的方法
            if (subject.isAuthenticated()) {
                mv.setViewName("main");
            }else{
    // mv.setViewName("redirect:/login.jsp");
                mv.setViewName("login"); //此处偷懒，一般是ajax请求，或重定向时将失败传回
                loginService.setSessionKey(request, user);
            }
    // return new ModelAndView("redirect:/login.jsp");
            return mv;

# 3.总结 #

我们一开始参加项目，最多的工作就是增删改查，其实，项目里面最核心的就是对数据库的处理，从数据库中取得数据，进行操作。

以上内容基本上占非增删改查操作的百分之六十，而一个项目的主要组成就是为实现业务进行增删改查。。。。

后面，将会对以上的代码进行实际中的总结。  
（主要是理解不够深入，只能浮在表面~）