升级sdk和添加默认密码

Author: heavyrian2012

config/application.properties

@@ -48,6 +48,9 @@ wfc.audio.cache.dir=/data/wfc/audio/cache
 # 详情请参考 https://www.baidu.com/s?wd=cookie+SameSite&ie=utf-8
 wfc.all_client_support_ssl=false
 
+## 是否添加用户默认密码。当使用组织架构服务导入员工信息后，员工无法直接登录。可以开启此配置，使用手机号码的后六位作为初始密码。首次登录之后必须修改密码。其他情况不用打开此开关。
+## 用户设置密码时，不能设置为手机号码的后6位
+wfc.default_user_password=false
 
 ## iOS系统使用share extension来处理分享，客户端无法调用SDK发送消息和文件，只能通过应用服务来进行。
 ## 这里配置为了满足iOS设备在share extension中进行上传文件的需求。

pom.xml

@@ -23,7 +23,7 @@
 		<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
 		<java.version>1.8</java.version>
 		<log4j2.version>2.17.2</log4j2.version>
-		<wfc.sdk.version>1.3.2</wfc.sdk.version>
+		<wfc.sdk.version>1.3.3</wfc.sdk.version>
 	</properties>
 
 	<dependencies>

src/lib/common-1.3.2.jar renamed to src/lib/common-1.3.3.jar

@@ -96,6 +96,9 @@ public class ServiceImpl implements Service {
     @Value("${im.admin_url}")
     private String adminUrl;
 
+    @Value("${wfc.default_user_password}")
+    private boolean defaultUserPwd;
+
     @Autowired
     private ShortUUIDGenerator userNameGenerator;
 
@@ -343,8 +346,13 @@ public RestResult loginWithMobileCode(HttpServletResponse httpResponse, String m
         return onLoginSuccess(httpResponse, mobile, clientId, platform, true);
     }
 
+    private String getUserDefaultPassword(String mobile) {
+        return mobile.length()>6?mobile.substring(mobile.length()-6):mobile;
+    }
+
     @Override
     public RestResult loginWithPassword(HttpServletResponse response, String mobile, String password, String clientId, int platform) {
+        boolean isUseDefaultPwd = false;
         try {
             IMResult<InputOutputUserInfo> userResult = UserAdmin.getUserByMobile(mobile);
             if (userResult.getErrorCode() == ErrorCode.ERROR_CODE_NOT_EXIST) {
@@ -355,9 +363,23 @@ public RestResult loginWithPassword(HttpServletResponse response, String mobile,
                 return RestResult.error(RestResult.RestCode.ERROR_SERVER_ERROR);
             }
             Optional<UserPassword> optional = userPasswordRepository.findById(userResult.getResult().getUserId());
+            String defaultPwd = getUserDefaultPassword(mobile);
             if (!optional.isPresent()) {
-                //当用户不存在或者密码不存在时，返回密码错误。避免被攻击遍历登录获取用户名。
-                return RestResult.error(ERROR_CODE_INCORRECT);
+                if (defaultUserPwd) {
+                    UserPassword up = new UserPassword(userResult.getResult().getUserId());
+                    up = changePassword(up, defaultPwd);
+                    optional = Optional.of(up);
+                    isUseDefaultPwd = true;
+                } else {
+                    //当用户不存在或者密码不存在时，返回密码错误。避免被攻击遍历登录获取用户名。
+                    return RestResult.error(ERROR_CODE_INCORRECT);
+                }
+            } else {
+                if (defaultUserPwd) {
+                    if (defaultPwd.equals(password)) {
+                        isUseDefaultPwd = true;
+                    }
+                }
             }
             UserPassword up = optional.get();
             if (up.getTryCount() > 5) {
@@ -407,7 +429,7 @@ public RestResult loginWithPassword(HttpServletResponse response, String mobile,
             return RestResult.error(RestResult.RestCode.ERROR_SERVER_ERROR);
         }
 
-        return onLoginSuccess(response, mobile, clientId, platform, false);
+        return onLoginSuccess(response, mobile, clientId, platform, isUseDefaultPwd);
     }
 
     @Override
@@ -480,7 +502,7 @@ public RestResult resetPassword(String mobile, String resetCode, String newPwd)
         }
     }
 
-    private void changePassword(UserPassword up, String password) throws Exception {
+    private UserPassword changePassword(UserPassword up, String password) throws Exception {
         MessageDigest digest = MessageDigest.getInstance(Sha1Hash.ALGORITHM_NAME);
         digest.reset();
         String salt = UUID.randomUUID().toString();
@@ -490,6 +512,7 @@ private void changePassword(UserPassword up, String password) throws Exception {
         up.setPassword(hashedPwd);
         up.setSalt(salt);
         userPasswordRepository.save(up);
+        return up;
     }
 
     private boolean verifyPassword(UserPassword up, String password) throws Exception {