package com.qsdbl.connect;
import com.mchange.v2.c3p0.ComboPooledDataSource;
import java.beans.PropertyVetoException;
import java.sql.Connection;
import java.sql.SQLException;
//qsdbl
//使用C3P0数据源（连接池和连接池管理合二为一），提高访问数据库的效率（第三方jar包）
//DAO（数据访问对象）的父类
public class BaseDao {
    private String address;//数据库的地址或域名，例如：qsdbl.site
    private String database_name;//数据库名
    private String user;//有权限访问数据库的用户，用户名
    private String passwd;//对应的密码
    private int maxPoolSize = 40;//连接池最大连接数(这里给个默认值）
    private int minPoolSize = 2;//连接池最小连接数
    private int initialPoolSize = 10;//初始化时获取的连接数
    private int maxStatements = 180;//一个连接的缓存Statement对象的最大数
    //数据源
    public ComboPooledDataSource ds;
    //构造方法
    public BaseDao(String address,String database_name,String user,String passwd) throws PropertyVetoException {
        this.address = address;
        this.database_name = database_name;
        this.user = user;
        this.passwd = passwd;
        init();
    }
    //该方法 用于返回数据源对象（C3P0）
    public void init() throws PropertyVetoException {
        ds = new ComboPooledDataSource();
        //连接mysql数据库
        ds.setDriverClass("com.mysql.cj.jdbc.Driver");
        //数据库URL，database_name为数据库名
        ds.setJdbcUrl(String.format("jdbc:mysql://%s:3306/%s",address,database_name));
        //设置有权限访问数据库的账户和密码
        ds.setUser(user);
        ds.setPassword(passwd);
        //设置连接池中保留的最大/最小连接数
        ds.setMaxPoolSize(maxPoolSize);
        ds.setMinPoolSize(minPoolSize);
        //设置初始化时获取的连接数
        ds.setInitialPoolSize(initialPoolSize);
        //设置连接池中一个连接的缓存Statement对象的最大数
        ds.setMaxStatements(maxStatements);
    }
    //获取数据库连接对象
    public Connection getConnection() throws SQLException {
        return ds.getConnection();//使用c3p0数据源，返回一个Connection对象（java.sql.Connection;）
    }
}

package com.qsdbl.connect;
import java.beans.PropertyVetoException;
import java.util.Objects;
import java.sql.*;
//数据操作
//根据业务需要定义DAO的不同子类
public class Table_account extends BaseDao{
    private String table = "account";//该类，用于操作数据表account
    public void setTable(String table) {
        this.table = table;
    }
    public Table_account() throws PropertyVetoException {
        super("qsdbl.site","qsdbl","jack","12345Qsdbl--");
    }
    //添加账户
    public String add(Account account) throws SQLException {
        String sql = String.format("insert into %s ( user,passwd,type,mail) values (?,?,?,?);",table);
        Connection  con = null;
        PreparedStatement pstmt = null;
        try {
            con = ds.getConnection();
            pstmt = con.prepareStatement(sql);
            pstmt.setString(1, account.getUser());
            pstmt.setString(2, account.getPasswd());
            pstmt.setString(3, account.getType());
            pstmt.setString(4, account.getMail());
            pstmt.executeUpdate(); //执行更新
        } catch (SQLException throwables) {
            throwables.printStackTrace();
            return Integer.toString(throwables.getErrorCode());//返回错误代码
        }finally {
            if (pstmt != null){
                pstmt.close();
            }
            if (con != null){
                con.close();
            }
        }
        return "success";
    }
    //删除一个账户
    public String del(String username) throws SQLException {
//        String sql = String.format("delete from %d where user=?; ",table);
//        try {
//            Connection  con = ds.getConnection();
//            PreparedStatement pstmt = con.prepareStatement(sql);
//            pstmt.setString(1, account.getUser());
//            pstmt.executeUpdate();
//            pstmt.close();
//            con.close();
//            ds.close();
//        } catch (SQLException throwables) {
//            return Integer.toString(throwables.getErrorCode());//返回错误代码
//        }
//        return "success";
        //这里不是真正删除，而是将用户类型标记为已注销即可
        if (!Objects.equals(findByName(username),"")){//存在该用户才执行注销操作
            Account account = new Account();
            account.setUser(username);
            account.setType("deprecated");
            return alterType(account);//修改成功，则返回success
        }
        return null;
    }
    //修改密码（通过用户名）
    public String alterPasswd(Account account) throws SQLException {
        String sql = String.format("update %s set passwd=? where user=?; ",table);
        Connection  con = null;
        PreparedStatement pstmt = null;
        try {
            con = ds.getConnection();
            pstmt = con.prepareStatement(sql);
            pstmt.setString(1, account.getPasswd());
            pstmt.setString(2, account.getUser());
            pstmt.executeUpdate();
        } catch (SQLException throwables) {
            return Integer.toString(throwables.getErrorCode());//返回错误代码
        }finally {
            if (pstmt != null){
                pstmt.close();
            }
            if (con != null){
                con.close();
            }
        }
        return "success";
    }
    //修改类型（通过用户名）
    public String alterType(Account account) throws SQLException {
        String sql = String.format("update %s set type=? where user=?; ",table);
        Connection  con = null;
        PreparedStatement pstmt = null;
        try {
            con = ds.getConnection();
            pstmt = con.prepareStatement(sql);
            pstmt.setString(1, account.getType());
            pstmt.setString(2, account.getUser());
            pstmt.executeUpdate();
        } catch (SQLException throwables) {
            throwables.printStackTrace();
            return Integer.toString(throwables.getErrorCode());//返回错误代码
        }finally {
            if (pstmt != null){
                pstmt.close();
            }
            if (con != null){
                con.close();
            }
        }
        return "success";
    }
    //修改类型与密码（通过用户名）
    public String alterTypePasswd(Account account) throws SQLException {
        String sql = String.format("update %s set type=?,passwd=? where user=?; ",table);
        Connection  con = null;
        PreparedStatement pstmt = null;
        try {
            con = ds.getConnection();
            pstmt = con.prepareStatement(sql);
            pstmt.setString(1, account.getType());
            pstmt.setString(2, account.getPasswd());
            pstmt.setString(3, account.getUser());
            pstmt.executeUpdate();
        } catch (SQLException throwables) {
            return Integer.toString(throwables.getErrorCode());//返回错误代码
        }finally {
            if (pstmt != null){
                pstmt.close();
            }
            if (con != null){
                con.close();
            }
        }
        return "success";
    }
    //通过用户名 检索信息
    public Account findByName(String username) throws SQLException {
        Account account = new Account();
        String sql = String.format("select * from %s where user=?; ",table);
        Connection  con = null;
        PreparedStatement pstmt = null;
        ResultSet rst = null;
        try {
            con = ds.getConnection();
            pstmt = con.prepareStatement(sql);
            pstmt.setString(1, username);
            rst = pstmt.executeQuery();
            if (rst.next()){
                //将获取到的数据添加到Account对象中
                account.setId(Integer.parseInt(rst.getString("id")));
                account.setUser(rst.getString("user"));
                account.setPasswd(rst.getString("passwd"));
                account.setType(rst.getString("type"));
                account.setTime(rst.getDate("time"));
                account.setTimeup(rst.getTimestamp("timeup"));
            }
        } catch (SQLException throwables) {
            throwables.printStackTrace();
            return null;
        }finally {
            if (rst != null){
                rst.close();
            }
            if (pstmt != null){
                pstmt.close();
            }
            if (con != null){
                con.close();
            }
        }
        return account;
    }
    //查看数据库中的用户数量
    public int find_Sum(Account account) throws SQLException {
        String sql = String.format("select count(*) from %s;",table);
        Connection  con = null;
        PreparedStatement pstmt = null;
        ResultSet rst = null;
        int sum = 0;
        try {
            con = ds.getConnection();
            pstmt = con.prepareStatement(sql);
            rst = pstmt.executeQuery();
            if (rst.next()){
                sum = rst.getInt(1);
            }
        } catch (SQLException throwables) {
            return throwables.getErrorCode();//返回错误代码
        }finally {
            if (rst != null){
                rst.close();
            }
            if (pstmt != null){
                pstmt.close();
            }
            if (con != null){
                con.close();
            }
        }
        return sum;
    }
    //查看数据库中 是否存在 某用户，exist，存在，none，不存在，error，错误
    public String find_name(String username) throws SQLException {
        String sql = String.format("select count(*) from %s where user=?;",table);
        Connection  con = null;
        PreparedStatement pstmt = null;
        ResultSet rst = null;
        int sum = 0;
        try {
            con = ds.getConnection();
            pstmt = con.prepareStatement(sql);
            pstmt.setString(1,username);
            rst = pstmt.executeQuery();
            if (rst.next()){
                sum = rst.getInt(1);
            }
        } catch (SQLException throwables) {
            return "error";
        }finally {
            if (rst != null){
                rst.close();
            }
            if (pstmt != null){
                pstmt.close();
            }
            if (con != null){
                con.close();
            }
        }
        if (sum > 0){
            return "exist";
        }else {
            return "none";
        }
    }
    //检查 账号密码 是否正确
    public boolean check_passwd(Account account) throws SQLException {
        String sql = String.format("select count(*) from %s where user=? && passwd=?;",table);
        Connection  con = null;
        PreparedStatement pstmt = null;
        ResultSet rst = null;
        int sum = 0;
        try {
            con = ds.getConnection();
            pstmt = con.prepareStatement(sql);
            pstmt.setString(1,account.getUser());
            pstmt.setString(2,account.getPasswd());
            rst = pstmt.executeQuery();
            if (rst.next()){
                sum = rst.getInt(1);
            }
        } catch (SQLException throwables) {
            throwables.printStackTrace();
            return false;
        }finally {
            if (rst != null){
                rst.close();
            }
            if (pstmt != null){
                pstmt.close();
            }
            if (con != null){
                con.close();
            }
        }
        if (sum > 0){
            return true;
        }else {
            return false;
        }
    }
}

package com.qsdbl.connect;
import java.sql.Timestamp;
import java.sql.Date;
//针对不同的数据，设计不同的bean类
//该类对应数据库中的account表的一行数据（一个account对象），用于存储从数据库中返回的数据
public class Account {
    private int id;
    private String user;//用户名
    private String passwd;
    private String type = "common";
    private Date time;
    private Timestamp timeup;

    public Account() { 
    }
    public int getId() {
        return id;
    }
    public void setId(int id) {
        this.id = id;
    }
		...(get、set方法省略)
    public void setTimeup(Timestamp timeup) {
        this.timeup = timeup;
    }
}

package com.qsdbl.login;

import com.alibaba.fastjson.JSONObject;
import com.qsdbl.connect.Account;
import com.qsdbl.connect.Table_account;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.beans.PropertyVetoException;
import java.io.IOException;
import java.io.PrintWriter;
import java.util.Objects;

public class CheckLogin extends HttpServlet {
    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        //设置编码
        req.setCharacterEncoding("utf-8");
        resp.setCharacterEncoding("utf-8");
        resp.setContentType("application/json; charset=utf-8");//响应的数据为json类型

        //方便测试，数据库中内置用户有 pete，12345；lily，1314

        //status -- true，验证成功；false，验证失败
        //user -- 传递过来的 用户名
        //passwd -- 密码
        boolean status = false;
        //获取客户端提交的数据
        String user = req.getParameter("user");//用户名
        String passwd = req.getParameter("passwd");//密码

        //验证
        if (!Objects.equals(user,null) && !Objects.equals(passwd,null)){
            try {
                Account account = new Account();//创建账户对象
                account.setUser(user);
                account.setPasswd(passwd);
                status = new Table_account().check_passwd(account);//检查密码是否正确
            } catch (PropertyVetoException e) {
                e.printStackTrace();
            }
        }
        //生成json数据
        JSONObject o = new JSONObject();
        o.put("user", user);
        o.put("status",status);
        //发送验证结果给客户端
        PrintWriter writer = resp.getWriter();

        //为了处理跨域问题，将json改成jsonp
//        String funString = req.getParameter("callback");
//        writer.write(funString + "("+o.toString()+")");

        writer.write( o.toString());

        writer.flush();
        writer.close();

    }
    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        doPost(req, resp);
    }
}

package com.qsdbl.util;

import org.apache.commons.codec.binary.Base64;
import javax.crypto.Cipher;
import java.security.*;
import java.security.interfaces.RSAPublicKey;

public class RSAutils {//RSA加密
private static final KeyPair keyPair = initKey();
private static KeyPair initKey() {
    try {
        Provider provider =new org.bouncycastle.jce.provider.BouncyCastleProvider();
        Security.addProvider(provider);
        SecureRandom random = new SecureRandom();
        KeyPairGenerator generator = KeyPairGenerator.getInstance("RSA", provider);
        generator.initialize(1024,random);
        return generator.generateKeyPair();
    } catch(Exception e) {
        throw new RuntimeException(e);
    }
}
public static String generateBase64PublicKey() {//生成Base64公钥（发送给浏览器端）
    PublicKey publicKey = (RSAPublicKey)keyPair.getPublic();
    return new String(Base64.encodeBase64(publicKey.getEncoded()));
}
public static String decryptBase64(String string) {//base64解密
    return new String(decrypt(Base64.decodeBase64(string.getBytes())));
}
private static byte[] decrypt(byte[] byteArray) {
    try {
        Provider provider = new org.bouncycastle.jce.provider.BouncyCastleProvider();
        Security.addProvider(provider);
        Cipher cipher = Cipher.getInstance("RSA/ECB/PKCS1Padding", provider);
        PrivateKey privateKey = keyPair.getPrivate();
        cipher.init(Cipher.DECRYPT_MODE, privateKey);
        byte[] plainText = cipher.doFinal(byteArray);
        return plainText;
    } catch(Exception e) {
        throw new RuntimeException(e);
    }
}
}

package com.qsdbl.util;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

public class GetKey extends HttpServlet {
    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        req.setCharacterEncoding("utf-8");
        resp.setCharacterEncoding("utf-8");
        resp.setContentType("application/text; charset=utf-8");
        String publicKey = RSAutils.generateBase64PublicKey();//生成公钥
        resp.getWriter().write(publicKey);
    }

    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        doGet(req, resp);
    }
}

//获取客户端提交的数据（decryptBase64，解密）
String user = RSAutils.decryptBase64(req.getParameter("user").trim());//用户名
String passwd = RSAutils.decryptBase64(req.getParameter("passwd").trim());//密码

package com.qsdbl.util;
public class VerifiCode {
    private String uuid;
    private String verificode;

    public VerifiCode(String uuid, String verificode) {
        this.uuid = uuid;
        this.verificode = verificode;
    }
    public String getUuid() {
        return uuid;
    }
	...//省略get、set方法
    public void setVerificode(String verificode) {
        this.verificode = verificode;
    }
}

package com.qsdbl.util;
import com.alibaba.fastjson.JSONObject;
import javax.imageio.ImageIO;
import javax.imageio.stream.ImageOutputStream;
import javax.servlet.ServletContext;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.awt.*;
import java.awt.image.BufferedImage;
import java.io.*;
import java.util.*;
import java.util.List;

public class VerifiCodeImg extends HttpServlet {
    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        //uuid
        String uuid;
        if (req.getParameter("uuid") == null){//若客户端的请求中没有参数uuid
            return;//直接退出servlet程序
        }else {//有带上参数uuid
            uuid = req.getParameter("uuid");//获取 客户端发过来的uuid
            if (uuid.equals("")){//若客户端发过来的uuid为空，则创建一个
                uuid = UUID.randomUUID().toString();//生成uuid码
            }
        }
        //验证码超时时间
        int timeout = 30;//默认值;
        if (req.getParameter("timeout") != null){
            timeout = Integer.valueOf(req.getParameter("timeout"));
        }
        if (timeout <10 || timeout > 100){
            return;//验证码超时时间，只能是10～100。不符合要求，直接退出servlet程序
        }
//生成验证码：
        String vcode = getRandom();//生成随机 验证码
//添加验证码到Session中：
//        req.getSession().setAttribute("verificode",vcode);//若跨域，session无法保存验证码
//在验证码之间增加空格（为了美观）
        StringBuffer vcode_2=new StringBuffer();
        for(int i=0;i<vcode.length();i++){
            vcode_2.append(vcode.charAt(i)+" ");
        }

//在内存中创建一个图片：
        BufferedImage image = new BufferedImage(110,20,BufferedImage.TYPE_3BYTE_BGR);//宽、高、图片颜色类型

//准备绘制图片：
        Graphics2D g = (Graphics2D)image.getGraphics();//笔
//绘制背景颜色：
        g.setColor(Color.white);//设置画笔颜色
        g.fillRect(0,0,110,20);//起始x、y，结束x、y坐标。可以理解为宽、高为80*20

//绘制验证码：
        g.setColor(Color.black);//设置画笔颜色，即验证码（数字）的颜色
        g.setFont(new Font(null,Font.BOLD,15));//设置字体大小
        g.drawString(vcode_2.toString(),0,17);//绘制验证码

//生成干扰线条：
        for(int i=0;i<10;i++){
            Random random=new Random();
            int xBegin =random.nextInt(80);
            int yBegin =random.nextInt(20);
            int xEnd=random.nextInt(xBegin+30);
            int yEnd=random.nextInt(yBegin+30);
            g.setColor(getColor());//方法getColor，生成随机的颜色
            g.drawLine(xBegin, yBegin, xEnd, yEnd);//绘制线条
        }
        String vpath = saveImgToServer(image,timeout);//验证码图片 保存到服务器上（定时删掉）
        saveCodeToServer(vcode,uuid,timeout);//验证码（数字）与uuid保存到ServletContext中（定时删掉）

        resp.setContentType("application/jsonp; charset=utf-8");//响应的数据类型
        //发送给浏览器：
        JSONObject json = new JSONObject();//封装 json数据
        json.put("vpath", vpath);//图片路径
        json.put("uuid",uuid);//将uuid返回给客户端
        //为了处理跨域问题，将json改成jsonp
        String funString = req.getParameter("callback");

        //发送验证结果给客户端
        PrintWriter writer = resp.getWriter();
        writer.write(funString + "("+json.toString()+")");
        writer.flush();
        writer.close();
    }
    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        doGet(req, resp);
    }
    //获取7位数的随机数
    private String getRandom(){
      ...
    }
    //生成随机颜色
    private Color getColor(){
      ...
    }
    //保存 验证码 和 uuid 到ServletContext中
    private void saveCodeToServer(final String vcode, final String uuid, final int timeout){
      ...
    }
    //保存验证码图片到服务器上
    private String saveImgToServer(BufferedImage img, final int timeout) throws IOException {
      ...
    }

//获取7位数的随机数
private String getRandom(){
    String num = new Random().nextInt(1000000)+"";//取值范围是（包括前，不包括后）：[0,n)
    StringBuffer supplement = new StringBuffer();
    for (int i = 1; i <= 7-num.length(); i++) {//如果生成的随机不是7位的，后边补0
        supplement.append("0");
    }
    num = supplement.toString() + num;
    return  num;
}

//生成随机颜色
private Color getColor(){
    Random random=new Random();
    int r =random.nextInt(256);
    int g =random.nextInt(256);
    int b =random.nextInt(256);
    return new Color(r,g,b);
}

//保存 验证码 和 uuid 到ServletContext中
private void saveCodeToServer(final String vcode, final String uuid, final int timeout){//vcode为验证码，数字。timeout为验证码失效时间
    VerifiCode verifiCode = new VerifiCode(uuid,vcode);//创建 验证码对象（保存uuid和验证码）
    List<VerifiCode> verificodelist;//保存到ServletContext的 验证码 集合
    final ServletContext servletContext = this.getServletContext();
    if (servletContext.getAttribute("verificode") == null){//若不存在 验证码集合，则创建一个
        verificodelist = new ArrayList<>();//应使用并发容器（例如CopyOnWriteArrayList或Vector）代替普通集合
    }else {//若存在，则从ServletContext中获取 验证码集合
        verificodelist = (List)servletContext.getAttribute("verificode");
    }

    //通过客户端提供的uuid，判断是否是同一个客户端再次申请验证码图片到前端
    boolean isUuid = false;//通过 一个标志位，判断是否是同一个客户端
    ListIterator iter = verificodelist.listIterator();//遍历集合
    while(iter.hasNext()) {
        VerifiCode vc = (VerifiCode)iter.next();
        if (Objects.equals(vc.getUuid(),uuid)){//存在相同的uuid，说明是同一个客户端的再次申请。
            //不添加新验证码对象到集合中，而是修改集合中的验证码对象中保存的验证码
            vc.setVerificode(vcode);//修改 验证码
            isUuid = true;
        }
    }
    if (!isUuid){//不是同一个客户端的再次申请，则添加新验证码对象到集合中
        verificodelist.add(verifiCode);//添加 验证码对象 到集合中
    }
    servletContext.setAttribute("verificode",verificodelist);//更新 ServletContext中的集合，key=verificode

    //定时删掉 该验证码对象（更新）
    new Thread(){
        @Override
        public void run() {
            super.run();
            try {
                sleep((timeout-3)*1000);//提前三秒删掉（考虑到网络延迟的问题）
                List<VerifiCode> verificodelist = (List)servletContext.getAttribute("verificode");
                ListIterator iter = verificodelist.listIterator();//遍历集合
                while(iter.hasNext()) {
                    VerifiCode vc = (VerifiCode)iter.next();
                    if (Objects.equals(vc.getUuid(),uuid)){
                        iter.remove();
                    }
                }
                servletContext.setAttribute("verificode",verificodelist);//更新 ServletContext中的集合
            } catch (InterruptedException e) {
                e.printStackTrace();
            }
        }
    }.start();
}

//保存验证码图片到服务器上
private String saveImgToServer(BufferedImage img, final int timeout) throws IOException {
    //验证码图片的 保存目录
    String imgRelativePath = "/img/vcodeImg";//相对路径
    String  imgName = System.currentTimeMillis()+".jpg";//图片名
    String vcodeParentPath = this.getServletContext().getRealPath(imgRelativePath);//绝对路径
    File vppFile = new File(vcodeParentPath);
    if (!vppFile.exists()){//判断目录是否存在
        boolean ismk = vppFile.mkdirs();//不存在，则创建这个目录（创建多级目录，使用mkdirs）
    }

    //在服务器上的保存路径（保存路径 加 文件名；uuid作为图片名）
    final String vcodePath = vcodeParentPath + "/" + imgName;

    //将图片保存到服务器上：
    //BufferedImage（内存中的验证码图片） 转 InputStream（输入流）
    InputStream inputStream = null;
    ByteArrayOutputStream bs = new ByteArrayOutputStream();
    try {
        ImageOutputStream imOut = ImageIO.createImageOutputStream(bs);
        ImageIO.write(img, "jpg",imOut);
        inputStream= new ByteArrayInputStream(bs.toByteArray());
    } catch (IOException e) {
        e.printStackTrace();
    }

    //创建一个文件输出流
    FileOutputStream fos = new FileOutputStream(vcodePath);
    //创建一个缓冲区
    byte[] buffer = new byte[1024*1024];
    //判断是否读取完毕
    int len = 0;
    //如果大于0，说明还存在数据（将图片保存到服务器上）
    while ((len = inputStream.read(buffer)) > 0){
        fos.write(buffer,0,len);
    }
    //关闭流
    fos.flush();
    fos.close();
    inputStream.close();

    //超时（timeout）后自动删掉验证码图片
    new Thread(){
        @Override
        public void run() {
            try {
                sleep((timeout)*1000);//模拟 定时器
            } catch (InterruptedException e) {
                e.printStackTrace();
            }
            File vcodeImg = new File(vcodePath);
            if (vcodeImg.exists()){
                vcodeImg.delete();//删掉验证码图片
            }
        }
    }.start();

    return imgRelativePath+"/"+imgName;//返回 图片保存路径（相对路径）
}

package com.qsdbl.login;

import com.alibaba.fastjson.JSONObject;
import com.qsdbl.connect.Account;
import com.qsdbl.connect.Table_account;
import com.qsdbl.util.RSAutils;
import com.qsdbl.util.VerifiCode;
import javax.servlet.ServletContext;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.beans.PropertyVetoException;
import java.io.IOException;
import java.io.PrintWriter;
import java.util.List;
import java.util.ListIterator;
import java.util.Objects;

public class CheckLogin extends HttpServlet {
    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        //查看客户端 发过来的 参数（字段）是否合法
        if (!checkParameter(new String[]{"user","passwd","verificode","uuid"},req)){//false，表示缺少某个字段
            return;//退出程序
        }
        //设置响应类型
        resp.setContentType("application/jsonp; charset=utf-8");

        //方便测试，内置用户有 pete，12345；lily，1314

        //status -- true，验证成功；false，验证失败
        //user -- 传递过来的 用户名
        //passwd -- 密码
        boolean status = false;
        boolean isVerificode = false;
        String type = "";
        //获取客户端提交的数据（decryptBase64，解密）
        String user = RSAutils.decryptBase64(req.getParameter("user").trim());//用户名
        String passwd = RSAutils.decryptBase64(req.getParameter("passwd").trim());//密码
        String user_verificode = RSAutils.decryptBase64(req.getParameter("verificode").trim());//用户提交的验证码
        String user_uuid = RSAutils.decryptBase64(req.getParameter("uuid").trim());//用户提交的uuid

        //String verificode = req.getSession().getAttribute("verificode").toString();
        //Session中保存的验证码（跨域，无法使用session保存验证码）
        //使用方法checkVcode实现（保存到ServletContext中）

        if (checkVcode(user_verificode,user_uuid)){//验证码相同，才验证账号、密码
            isVerificode = true;
            //验证账号、密码
            try {
                Account account = new Account();//创建账户对象
                account.setUser(user);
                account.setPasswd(passwd);
                //新增：添加判断账户状态
                Account databaseAccount = new Table_account().findByName(account.getUser());
                type = databaseAccount.getType();
                if (type.equals("admin") || type.equals("common")){//deprecated，废弃（注销状态）。admin，管理员。common，普通用户，deprecated_new，新用户待激活
                    //当前账户，是admin账户或common账户才可以进行登陆操作
                    status = new Table_account().check_passwd(account);//检查密码是否正确
                }
            } catch (Exception e) {
                e.printStackTrace();
            }
        }
        //封装json数据
        JSONObject json = new JSONObject();
        json.put("user", user);
        json.put("type",type);
        json.put("status",status);
        json.put("isVerificode",isVerificode);
        //为了处理跨域问题，将json改成jsonp
        String funString = req.getParameter("callback");
        //发送验证结果给客户端
        PrintWriter writer = resp.getWriter();
        writer.write(funString + "("+json.toString()+")");
        writer.flush();
        writer.close();

    }
    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        doPost(req, resp);
    }
  	//验证 客户端发来的验证码是否正确
    public static boolean checkVcode(String vcode,String uuid){
      ...
    }
  	//检查 参数是否合法（是否漏了某个参数）
    public static boolean checkParameter(String[] params,HttpServletRequest req){
        boolean status = true;//false，表示缺少某个字段
        for (int i = 0; i < params.length; i++) {
            if (Objects.equals(req.getParameter(params[i]),null)){
                status = false;
            }
        }
        return status;
    }
}

public static boolean checkVcode(String vcode,String uuid){//vcode为验证码，数字；uuid，为客户端发送过来的（获取验证码时发过去给客户端的）
    boolean status = false;//true，验证通过（验证码）
    VerifiCode verifiCode = new VerifiCode(uuid,vcode);//创建 验证码对象（保存uuid和验证码）

    final List<VerifiCode> verificodelist;//从ServletContext中获取 验证码 集合
    final ServletContext servletContext = this.getServletContext();
    if (servletContext.getAttribute("verificode") != null){//若存在 验证码集合
        verificodelist = (List)servletContext.getAttribute("verificode");
        ListIterator iter = verificodelist.listIterator();//遍历集合

        while(iter.hasNext()) {
            VerifiCode vc = (VerifiCode)iter.next();//获取具体的 验证码对象
            if (Objects.equals(vc.getUuid(),uuid) && Objects.equals(vc.getVerificode(),vcode)){
                //uuid与验证码都正确
                status = true;//验证通过
            }
        }
        servletContext.setAttribute("verificode",verificodelist);//更新 ServletContext中的集合
    }
    return status;
}

package com.qsdbl.filter;
import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

public class CorsFilter implements Filter {
    @Override
    public void init(FilterConfig filterConfig) throws ServletException {

    }
    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {

        // 跨域请求设置
        HttpServletResponse response =(HttpServletResponse)servletResponse;
        response.setHeader("Access-Control-Allow-Origin", "*");// *代表允许任何网址请求
        response.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE");// 允许请求的类型
        response.setHeader("Access-Control-Allow-Credentials","true");// 设置是否允许发送 cookies
        response.setHeader("Access-Control-Allow-Headers","*");// *代表允许任何请求头字段
        //顺便解决中文乱码
        response.setCharacterEncoding("utf-8");
        ((HttpServletRequest)servletRequest).setCharacterEncoding("utf-8");

        filterChain.doFilter(servletRequest,servletResponse);
    }
    @Override
    public void destroy() {

    }
}