|
|
@@ -44,6 +44,7 @@ import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
|
|
|
import org.springframework.ui.ModelMap;
|
|
|
import org.springframework.util.StringUtils;
|
|
|
|
|
|
+import javax.servlet.ServletException;
|
|
|
import javax.servlet.http.HttpServletRequest;
|
|
|
import javax.servlet.http.HttpServletResponse;
|
|
|
import java.io.*;
|
|
|
@@ -141,9 +142,6 @@ public class SSOInterceptor extends AbstractSSOInterceptor {
|
|
|
break;
|
|
|
}
|
|
|
}
|
|
|
- } else { // 如果这两个信息都不存在,判断未登录,因为存在个人账号能登录账户中心的情况
|
|
|
- SystemSession.clear();
|
|
|
- authorizedUser = null;
|
|
|
}
|
|
|
}
|
|
|
}
|
|
|
@@ -172,6 +170,7 @@ public class SSOInterceptor extends AbstractSSOInterceptor {
|
|
|
}
|
|
|
}
|
|
|
if (user != null) {
|
|
|
+ checkIsPersonal(user);
|
|
|
// 登录之前判断在当前企业的角色信息
|
|
|
if (null != user.getEnterprise() && user.getEnterprise().getEnAdminuu().equals(user.getUserUU())) {
|
|
|
Enterprise enterprise = user.getEnterprise();
|
|
|
@@ -315,6 +314,8 @@ public class SSOInterceptor extends AbstractSSOInterceptor {
|
|
|
}
|
|
|
}
|
|
|
if (user != null) {
|
|
|
+ // 判断是否个人用户
|
|
|
+ checkIsPersonal(user);
|
|
|
// 登录之前判断在当前企业的角色信息
|
|
|
if (null != user.getEnterprise() && user.getEnterprise().getEnAdminuu().equals(user.getUserUU())) {
|
|
|
Enterprise enterprise = user.getEnterprise();
|
|
|
@@ -331,7 +332,19 @@ public class SSOInterceptor extends AbstractSSOInterceptor {
|
|
|
}
|
|
|
}
|
|
|
|
|
|
- /**
|
|
|
+ /**
|
|
|
+ * 检验是否个人用户
|
|
|
+ *
|
|
|
+ * @param user 用户信息
|
|
|
+ */
|
|
|
+ private void checkIsPersonal(User user) {
|
|
|
+ boolean personalAccount = null == user.getEnterprise() || (null != user.getEnterprise() && null == user.getEnterprise().getUu());
|
|
|
+ if (personalAccount) {
|
|
|
+ throw new IllegalAccessError("个人用户无法使用B2B商务平台");
|
|
|
+ }
|
|
|
+ }
|
|
|
+
|
|
|
+ /**
|
|
|
* 权限验证
|
|
|
*/
|
|
|
private void accessDecision(HttpServletRequest request, User user) throws IOException {
|
|
|
@@ -410,7 +423,7 @@ public class SSOInterceptor extends AbstractSSOInterceptor {
|
|
|
String resourceMethod = resourceParam[0];
|
|
|
String resourceUrl = resourceParam[1];
|
|
|
AntPathRequestMatcher matcher = new AntPathRequestMatcher(resourceUrl);
|
|
|
- if (null != resourceUrl && request.getMethod().equals(resourceMethod) && matcher.matches(request)) {
|
|
|
+ if (request.getMethod().equals(resourceMethod) && matcher.matches(request)) {
|
|
|
return resourceMap.get(resourceKey);
|
|
|
}
|
|
|
}
|