From 843b9150055478d981f93fa6951a6d6509b03f57 Mon Sep 17 00:00:00 2001 From: chenxing Date: Thu, 3 Sep 2026 17:07:50 +0800 Subject: [PATCH] =?UTF-8?q?=E6=9B=B4=E6=94=B9=E7=99=BB=E5=BD=95=E9=A1=B5?= =?UTF-8?q?=E6=A0=B7=E5=BC=8F?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../web/custom/controller/LoginController.java | 15 +++++++++------ .../cas/web/custom/service/LoginService.java | 13 ------------- src/main/resources/templates/casLoginView.html | 2 +- 3 files changed, 10 insertions(+), 20 deletions(-) diff --git a/src/main/java/org/apereo/cas/web/custom/controller/LoginController.java b/src/main/java/org/apereo/cas/web/custom/controller/LoginController.java index ac86bb6..756ce91 100644 --- a/src/main/java/org/apereo/cas/web/custom/controller/LoginController.java +++ b/src/main/java/org/apereo/cas/web/custom/controller/LoginController.java @@ -144,12 +144,9 @@ public class LoginController { logger.info("用户 {} 尝试登录，Session ID: {}", loginName, session.getId()); - if (loginService.isAccountLocked(loginName)) { - respondError(request, response, - "账号已被锁定，请" + loginService.getAccountLockRemainingText(loginName) + "后重试"); - return; - } - + // 验证码先于锁定校验：需要验证码时必须先校验通过，再告知锁定状态。 + // 否则输错密码触发验证码后重新提交，只会收到“账号已被锁定”， + // 填写的验证码对错得不到任何反馈，用户无法判断该重填哪一项。 if (alwaysCaptcha || loginService.needCaptcha(session)) { if (captchaText == null || captchaText.trim().isEmpty()) { respondError(request, response, "请输入验证码", true); @@ -161,6 +158,12 @@ public class LoginController { } } + if (loginService.isAccountLocked(loginName)) { + respondError(request, response, + "账号已被锁定，请" + loginService.getAccountLockRemainingText(loginName) + "后重试"); + return; + } + LocalAuthenticationResult authResult = authenticate(loginName, password); if (authResult.success) { diff --git a/src/main/java/org/apereo/cas/web/custom/service/LoginService.java b/src/main/java/org/apereo/cas/web/custom/service/LoginService.java index f9cd273..7e2492f 100644 --- a/src/main/java/org/apereo/cas/web/custom/service/LoginService.java +++ b/src/main/java/org/apereo/cas/web/custom/service/LoginService.java @@ -165,17 +165,4 @@ public class LoginService { session.removeAttribute("CAPTCHA_TEXT"); return savedText.equalsIgnoreCase(captchaText); } - - /** - * 综合判断：是否需要验证码（Session 失败 >= 3 次） - * 如果账号已锁定，也返回 true（但 controller 会先检查锁定） - */ - public boolean needCaptcha(HttpSession session, String loginName) { - // Session 级别失败 >= 3 次，需要验证码 - if (getSessionFailCount(session) >= CAPTCHA_THRESHOLD) { - return true; - } - // 账号被锁定也需要验证码（但 controller 会直接拒绝） - return isAccountLocked(loginName); - } } diff --git a/src/main/resources/templates/casLoginView.html b/src/main/resources/templates/casLoginView.html index ad52443..b9dde6d 100644 --- a/src/main/resources/templates/casLoginView.html +++ b/src/main/resources/templates/casLoginView.html @@ -55,7 +55,7 @@
-