331 lines
14 KiB
Plaintext
331 lines
14 KiB
Plaintext
|
<%@ page import="weaver.general.*,java.io.*,java.util.*" %>
|
|||
|
|
|
|||
|
|
<%@ page language="java" contentType="text/html; charset=UTF-8" %>
|
|||
|
|
<%@ page import="weaver.hrm.*" %>
|
|||
|
|
<%@ page import="java.lang.reflect.Method" %>
|
|||
|
|
<jsp:useBean id="rs" class="weaver.conn.RecordSet" scope="page"/>
|
|||
|
|
<jsp:useBean id="rs1" class="weaver.conn.RecordSet" scope="page"/>
|
|||
|
|
<jsp:useBean id="sub" class="weaver.hrm.company.SubCompanyComInfo" scope="page"/>
|
|||
|
|
<html>
|
|||
|
|
<head>
|
|||
|
|
<title>高效源于协同</title>
|
|||
|
|
<%--<link rel="stylesheet" href="/css/frame.css" type="text/css">--%>
|
|||
|
|
<script type="text/javascript">
|
|||
|
|
function lockAccount() {
|
|||
|
|
if (confirm("确认要禁用弱密码账号吗？")) {
|
|||
|
|
location.href = "weak.jsp?src=1";
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
</script>
|
|||
|
|
</head>
|
|||
|
|
<body>
|
|||
|
|
<%
|
|||
|
|
List<Map<String, String>> weakResources = new ArrayList<Map<String, String>>();
|
|||
|
|
List<Map<String, String>> weakResourcesManager = new ArrayList<Map<String, String>>();
|
|||
|
|
|
|||
|
|
try {
|
|||
|
|
User user = HrmUserVarify.getUser(request, response);
|
|||
|
|
if (user == null) {
|
|||
|
|
response.sendRedirect("/login/Login.jsp");
|
|||
|
|
return;
|
|||
|
|
}
|
|||
|
|
weaver.filter.XssUtil xssUtil = new weaver.filter.XssUtil();
|
|||
|
|
int UID = xssUtil.getIntValue(""+xssUtil.getRule().get("userID"),1);
|
|||
|
|
if (user.getUID() != UID) {
|
|||
|
|
response.sendRedirect("/notice/noright.jsp");
|
|||
|
|
return;
|
|||
|
|
}
|
|||
|
|
int src = Util.getIntValue(request.getParameter("src"), -1);
|
|||
|
|
|
|||
|
|
String pathname = xssUtil.getRootPath() + "WEB-INF/securityRule/weak_stand.txt"; // 绝对路径或相对路径都可以，这里是绝对路径，写入文件时演示相对路径
|
|||
|
|
File filename = new File(pathname); // 要读取以上路径的input.txt文件
|
|||
|
|
InputStreamReader reader = null;
|
|||
|
|
BufferedReader br = null;
|
|||
|
|
Set<String> weakPsd = new HashSet<String>();
|
|||
|
|
Set<String> weakSet = new HashSet<String>();
|
|||
|
|
try {
|
|||
|
|
reader = new InputStreamReader(
|
|||
|
|
new FileInputStream(filename)); // 建立一个输入流对象reader
|
|||
|
|
br = new BufferedReader(reader); // 建立一个对象，它把文件内容转成计算机能读懂的语言
|
|||
|
|
|
|||
|
|
String line = br.readLine();
|
|||
|
|
weakPsd.add(Util.getEncrypt(""));
|
|||
|
|
weakSet.add("");
|
|||
|
|
|
|||
|
|
while (line != null) {
|
|||
|
|
weakSet.add(line);
|
|||
|
|
line = Util.getEncrypt("".equals(line.trim()) ? "1" : line); // 一次读入一行数据
|
|||
|
|
weakPsd.add(line);
|
|||
|
|
line = br.readLine();
|
|||
|
|
}
|
|||
|
|
}catch(Exception e){
|
|||
|
|
|
|||
|
|
}finally {
|
|||
|
|
if(br!=null){
|
|||
|
|
try {
|
|||
|
|
br.close();
|
|||
|
|
}catch (Exception e){}
|
|||
|
|
}
|
|||
|
|
if(reader !=null){
|
|||
|
|
try {
|
|||
|
|
reader.close();
|
|||
|
|
}catch (Exception e){}
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
//自定义的弱密码规则库
|
|||
|
|
pathname = xssUtil.getRootPath() + "WEB-INF/securityRule/weak.txt"; // 绝对路径或相对路径都可以，这里是绝对路径，写入文件时演示相对路径
|
|||
|
|
filename = new File(pathname); // 要读取以上路径的input.txt文件
|
|||
|
|
try {
|
|||
|
|
reader = new InputStreamReader(
|
|||
|
|
new FileInputStream(filename)); // 建立一个输入流对象reader
|
|||
|
|
br = new BufferedReader(reader); // 建立一个对象，它把文件内容转成计算机能读懂的语言
|
|||
|
|
String line = br.readLine();
|
|||
|
|
|
|||
|
|
while (line != null) {
|
|||
|
|
if(!weakSet.contains(line)) {
|
|||
|
|
weakSet.add(line);
|
|||
|
|
line = Util.getEncrypt("".equals(line.trim()) ? "1" : line); // 一次读入一行数据
|
|||
|
|
weakPsd.add(line);
|
|||
|
|
}
|
|||
|
|
line = br.readLine();
|
|||
|
|
}
|
|||
|
|
}catch(Exception e){
|
|||
|
|
|
|||
|
|
}finally {
|
|||
|
|
if(br!=null){
|
|||
|
|
try {
|
|||
|
|
br.close();
|
|||
|
|
}catch (Exception e){}
|
|||
|
|
}
|
|||
|
|
if(reader !=null){
|
|||
|
|
try {
|
|||
|
|
reader.close();
|
|||
|
|
}catch (Exception e){}
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
//manager账户数量不会太多
|
|||
|
|
|
|||
|
|
/**
|
|||
|
|
* MD5加密账户弱密码校验策略
|
|||
|
|
*/
|
|||
|
|
String sql_manager = "select id,password,loginid from hrmresourcemanager";
|
|||
|
|
rs.execute(sql_manager);
|
|||
|
|
|
|||
|
|
while (rs.next()) {
|
|||
|
|
String password = rs.getString("password");
|
|||
|
|
if (!weakPsd.contains(password)) {
|
|||
|
|
continue;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
Map<String, String> data = new HashMap<String, String>();
|
|||
|
|
int id = rs.getInt("id");
|
|||
|
|
data.put("loginid", rs.getString("loginid"));
|
|||
|
|
weakResourcesManager.add(data);
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
String sql = "select id,password,loginid,lastname,lastlogindate,passwordlock,passwdchgdate,subcompanyid1 from hrmresource where loginid is not null and status in (0,1,2,3)";
|
|||
|
|
//检查是否启用了账号锁定策略，如果启动了账号锁定，则被锁定的账号不查询出来
|
|||
|
|
rs.executeSql("select openPasswordLock from hrmsettings");
|
|||
|
|
if(rs.next()){
|
|||
|
|
int openPasswordLock = rs.getInt("openPasswordLock");
|
|||
|
|
if(openPasswordLock == 1){
|
|||
|
|
sql = "select id,password,loginid,lastname,lastlogindate,passwordlock,passwdchgdate,subcompanyid1 from hrmresource where loginid is not null and status in (0,1,2,3) and (passwordlock is null or passwordlock = '' or passwordlock = 0)";
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
rs.execute(sql);
|
|||
|
|
while (rs.next()) {
|
|||
|
|
|
|||
|
|
String password = rs.getString("password");
|
|||
|
|
if (!weakPsd.contains(password)) {
|
|||
|
|
continue;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
Map<String, String> data = new HashMap<String, String>();
|
|||
|
|
String lastlogindate = rs.getString("lastlogindate");
|
|||
|
|
int id = rs.getInt("id");
|
|||
|
|
String passwordlock = rs.getString("passwordlock");
|
|||
|
|
data.put("loginid", rs.getString("loginid"));
|
|||
|
|
data.put("lastname", rs.getString("lastname"));
|
|||
|
|
data.put("lastlogindate", rs.getString("lastlogindate"));
|
|||
|
|
data.put("passwordlock", rs.getString("passwordlock"));
|
|||
|
|
data.put("passwdchgdate", rs.getString("passwdchgdate"));
|
|||
|
|
data.put("subcompanyid1", rs.getString("subcompanyid1"));
|
|||
|
|
weakResources.add(data);
|
|||
|
|
if (src == 1) {
|
|||
|
|
//执行sql语句禁用此账号，如果超过3个月
|
|||
|
|
int deta = TimeUtil.dateInterval(lastlogindate, TimeUtil.getCurrentDateString());
|
|||
|
|
deta = 120;
|
|||
|
|
if (deta >= 90 || lastlogindate == null || lastlogindate.equals("")) {
|
|||
|
|
rs1.execute("update hrmresource set passwordlock=1 where id = "+id);
|
|||
|
|
xssUtil.writeLog(">>>禁用弱密码账号:loginid-->" + rs.getString("loginid") + ">>>lastname-->" + rs.getString("lastname") + ">>>lastlogindate-->" + lastlogindate);
|
|||
|
|
continue;
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
}
|
|||
|
|
/**
|
|||
|
|
* SM3 加密 弱密码用户列表
|
|||
|
|
*/
|
|||
|
|
|
|||
|
|
Class<?> threadClazz = null;
|
|||
|
|
Method encryptMethod = null;
|
|||
|
|
Object newInstance = null;
|
|||
|
|
try {
|
|||
|
|
threadClazz = Class.forName("weaver.sm.SM3Utils");
|
|||
|
|
newInstance = threadClazz.newInstance();
|
|||
|
|
encryptMethod = threadClazz.getMethod("getEncrypt", String.class, String.class);
|
|||
|
|
} catch (Exception e) {
|
|||
|
|
}
|
|||
|
|
if (threadClazz != null && newInstance != null && encryptMethod != null) {
|
|||
|
|
String sql_manager_sm3 = "select id,password,loginid,salt from hrmresourcemanager where salt is not null and length(salt) > 1";
|
|||
|
|
rs.execute(sql_manager_sm3);
|
|||
|
|
|
|||
|
|
while (rs.next()) {
|
|||
|
|
|
|||
|
|
int id = rs.getInt("id");
|
|||
|
|
String password = rs.getString("password");
|
|||
|
|
String salt = rs.getString("salt");
|
|||
|
|
if (salt.contains("sm3_new#")) {
|
|||
|
|
salt = salt.split("sm3_new#")[1];
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
for (String s : weakSet) {
|
|||
|
|
String encryptSM3pwd = null;
|
|||
|
|
try {
|
|||
|
|
encryptSM3pwd = (String) encryptMethod.invoke(newInstance, s, salt);
|
|||
|
|
} catch (Exception e) {
|
|||
|
|
e.printStackTrace();
|
|||
|
|
}
|
|||
|
|
if (encryptSM3pwd != null && encryptSM3pwd.equals(password)) {
|
|||
|
|
Map<String, String> data = new HashMap<String, String>();
|
|||
|
|
data.put("loginid", rs.getString("loginid"));
|
|||
|
|
weakResourcesManager.add(data);
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
String sql_sm3 = "select id,password,loginid,lastname,lastlogindate,passwordlock,passwdchgdate,salt,subcompanyid1 from hrmresource where loginid is not null and salt is not null and length(salt) > 1 and status in (0,1,2,3)";
|
|||
|
|
//检查是否启用了账号锁定策略，如果启动了账号锁定，则被锁定的账号不查询出来
|
|||
|
|
rs.executeSql("select openPasswordLock from hrmsettings");
|
|||
|
|
if(rs.next()){
|
|||
|
|
int openPasswordLock = rs.getInt("openPasswordLock");
|
|||
|
|
if(openPasswordLock == 1){
|
|||
|
|
sql_manager_sm3 = "select id,password,loginid,lastname,lastlogindate,passwordlock,passwdchgdate,subcompanyid1 from hrmresource where loginid is not null and salt is not null and length(salt) > 1 and status in (0,1,2,3) and (passwordlock is null or passwordlock = '' or passwordlock = 0)";
|
|||
|
|
}
|
|||
|
|
} rs.execute(sql_sm3);
|
|||
|
|
while (rs.next()) {
|
|||
|
|
|
|||
|
|
int id = rs.getInt("id");
|
|||
|
|
String password = rs.getString("password");
|
|||
|
|
String salt = rs.getString("salt");
|
|||
|
|
if (salt.contains("sm3_new#")) {
|
|||
|
|
salt = salt.split("sm3_new#")[1];
|
|||
|
|
}
|
|||
|
|
for (String s : weakSet) {
|
|||
|
|
String encryptSM3pwd = null;
|
|||
|
|
try {
|
|||
|
|
encryptSM3pwd = (String) encryptMethod.invoke(newInstance, s, salt);
|
|||
|
|
} catch (Exception e) {
|
|||
|
|
e.printStackTrace();
|
|||
|
|
}
|
|||
|
|
if (encryptSM3pwd != null && encryptSM3pwd.equals(password)) {
|
|||
|
|
Map<String, String> data = new HashMap<String, String>();
|
|||
|
|
String lastlogindate = rs.getString("lastlogindate");
|
|||
|
|
String passwordlock = rs.getString("passwordlock");
|
|||
|
|
data.put("loginid", rs.getString("loginid"));
|
|||
|
|
data.put("lastname", rs.getString("lastname"));
|
|||
|
|
data.put("lastlogindate", rs.getString("lastlogindate"));
|
|||
|
|
data.put("passwordlock", rs.getString("passwordlock"));
|
|||
|
|
data.put("passwdchgdate", rs.getString("passwdchgdate"));
|
|||
|
|
data.put("subcompanyid1", rs.getString("subcompanyid1"));
|
|||
|
|
weakResources.add(data);
|
|||
|
|
if (src == 1) {
|
|||
|
|
//执行sql语句禁用此账号，如果超过3个月
|
|||
|
|
int deta = TimeUtil.dateInterval(lastlogindate, TimeUtil.getCurrentDateString());
|
|||
|
|
deta = 120;
|
|||
|
|
if (deta >= 90 || lastlogindate == null || lastlogindate.equals("")) {
|
|||
|
|
rs1.execute("update hrmresource set passwordlock=1 where id = "+ id);
|
|||
|
|
xssUtil.writeLog(">>>禁用弱密码账号:loginid-->" + rs.getString("loginid") + ">>>lastname-->" + rs.getString("lastname") + ">>>lastlogindate-->" + lastlogindate);
|
|||
|
|
continue;
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
} catch (Exception e) {
|
|||
|
|
}
|
|||
|
|
%>
|
|||
|
|
|
|||
|
|
<% if (weakResourcesManager.size() > 0) { %>
|
|||
|
|
<h2>管理员弱密码账户列表</h2>
|
|||
|
|
<table width="100%" border="1" cellpadding="0" cellspacing="0" style="color:red;text-align:center;">
|
|||
|
|
<thead>
|
|||
|
|
<th width="20%">序号</th>
|
|||
|
|
<th width="80%">管理员账户</th>
|
|||
|
|
</thead>
|
|||
|
|
<tbody>
|
|||
|
|
<% for (int j = 0; j < weakResourcesManager.size(); j++) {
|
|||
|
|
Map<String, String> data = weakResourcesManager.get(j);
|
|||
|
|
%>
|
|||
|
|
<tr>
|
|||
|
|
<td><%=j + 1%>
|
|||
|
|
</td>
|
|||
|
|
<td><%=data.get("loginid")%>
|
|||
|
|
</td>
|
|||
|
|
</tr>
|
|||
|
|
<%}%>
|
|||
|
|
</tbody>
|
|||
|
|
|
|||
|
|
</table>
|
|||
|
|
<br/><br/><br/><br/>
|
|||
|
|
<%
|
|||
|
|
}
|
|||
|
|
if (weakResources.size() > 0) {
|
|||
|
|
%>
|
|||
|
|
|
|||
|
|
<h2>普通弱密码账户列表</h2>
|
|||
|
|
<div style="text-algin:right;">
|
|||
|
|
<button type="button" name="lockBtn" id="lockBtn" value="禁用弱密码账号" onclick="lockAccount();">禁用弱密码账号</button>
|
|||
|
|
</div>
|
|||
|
|
<table width="100%" border="1" cellpadding="0" cellspacing="0" style="color:red;text-align:center;">
|
|||
|
|
<thead>
|
|||
|
|
<th width="10%">序号</th>
|
|||
|
|
<th width="20%">登录账号</th>
|
|||
|
|
<th width="20%">姓名</th>
|
|||
|
|
<th width="20%">分部</th>
|
|||
|
|
<th width="15%">最后登录时间</th>
|
|||
|
|
<th width="15%">最后修改密码时间</th>
|
|||
|
|
</thead>
|
|||
|
|
<tbody>
|
|||
|
|
<% for (int j = 0; j < weakResources.size(); j++) {
|
|||
|
|
Map<String, String> data = weakResources.get(j); %>
|
|||
|
|
<tr>
|
|||
|
|
<td><%=j + 1%>
|
|||
|
|
</td>
|
|||
|
|
<td><%=data.get("loginid")%>
|
|||
|
|
</td>
|
|||
|
|
<td><%=data.get("lastname")%>
|
|||
|
|
</td>
|
|||
|
|
<td><%=sub.getSubCompanyname(data.get("subcompanyid1"))%>
|
|||
|
|
</td>
|
|||
|
|
<td><%=data.get("lastlogindate")%>
|
|||
|
|
</td>
|
|||
|
|
<td><%=data.get("passwdchgdate")%>
|
|||
|
|
</td>
|
|||
|
|
</tr>
|
|||
|
|
<%}%>
|
|||
|
|
</tbody>
|
|||
|
|
</table>
|
|||
|
|
<%
|
|||
|
|
}
|
|||
|
|
if (weakResourcesManager.size() == 0 && weakResources.size() == 0) {
|
|||
|
|
%>
|
|||
|
|
<h3 style="color:green;text-align:center;"><br/><br/><br/><br/>系统未检测到用户弱密码！</h3>
|
|||
|
|
<%}%>
|
|||
|
|
</body>
|
|||
|
|
|
|||
|
|
</html>
|