🔒 Fix #12330

pom.xml

@@ -75,7 +75,7 @@
     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 
-        <org.b3log.latke.version>2.3.13</org.b3log.latke.version>
+        <org.b3log.latke.version>2.3.14-SNAPSHOT</org.b3log.latke.version>
 
         <servlet.version>3.1.0</servlet.version>
         <slf4j.version>1.7.5</slf4j.version>

src/main/java/org/b3log/solo/service/UserMgmtService.java

@@ -30,6 +30,7 @@ import org.b3log.latke.repository.Transaction;
 import org.b3log.latke.service.LangPropsService;
 import org.b3log.latke.service.ServiceException;
 import org.b3log.latke.service.annotation.Service;
+import org.b3log.latke.util.Crypts;
 import org.b3log.latke.util.MD5;
 import org.b3log.latke.util.Sessions;
 import org.b3log.latke.util.Strings;
@@ -47,7 +48,7 @@ import javax.servlet.http.HttpServletResponse;
  *
  * @author <a href="http://88250.b3log.org">Liang Ding</a>
  * @author <a href="mailto:385321165@qq.com">DASHU</a>
- * @version 1.1.0.8, May 25, 2017
+ * @version 1.1.0.9, Aug 11, 2017
  * @since 0.4.0
  */
 @Service
@@ -83,7 +84,6 @@ public class UserMgmtService {
      */
     public void tryLogInWithCookie(final HttpServletRequest request, final HttpServletResponse response) {
         final Cookie[] cookies = request.getCookies();
-
         if (null == cookies || 0 == cookies.length) {
             return;
         }
@@ -91,38 +91,45 @@ public class UserMgmtService {
         try {
             for (int i = 0; i < cookies.length; i++) {
                 final Cookie cookie = cookies[i];
-                if (!"b3log-latke".equals(cookie.getName())) {
+                if (!Sessions.COOKIE_NAME.equals(cookie.getName())) {
                     continue;
                 }
 
-                final JSONObject cookieJSONObject = new JSONObject(cookie.getValue());
+                final String value = Crypts.decryptByAES(cookie.getValue(), Sessions.COOKIE_SECRET);
+                final JSONObject cookieJSONObject = new JSONObject(value);
 
-                final String userEmail = cookieJSONObject.optString(User.USER_EMAIL);
-                if (Strings.isEmptyOrNull(userEmail)) {
+                final String userId = cookieJSONObject.optString(Keys.OBJECT_ID);
+                if (Strings.isEmptyOrNull(userId)) {
                     break;
                 }
 
                 final LatkeBeanManager beanManager = Lifecycle.getBeanManager();
                 final UserQueryService userQueryService = beanManager.getReference(UserQueryService.class);
 
-                final JSONObject user = userQueryService.getUserByEmail(userEmail.toLowerCase().trim());
+                final JSONObject userResult = userQueryService.getUser(userId);
+                if (null == userResult) {
+                    break;
+                }
 
+                final JSONObject user = userResult.getJSONObject(User.USER);
                 if (null == user) {
                     break;
                 }
 
                 final String userPassword = user.optString(User.USER_PASSWORD);
-                final String hashPassword = cookieJSONObject.optString(User.USER_PASSWORD);
+                final String token = cookieJSONObject.optString(Keys.TOKEN);
+                final String hashPassword = StringUtils.substringBeforeLast(token, ":");
 
                 if (userPassword.equals(hashPassword)) {
                     Sessions.login(request, response, user);
-                    LOGGER.log(Level.DEBUG, "Logged in with cookie[email={0}]", userEmail);
+
+                    LOGGER.log(Level.DEBUG, "Logged in with cookie [email={0}]", user.optString(User.USER_EMAIL));
                 }
             }
         } catch (final Exception e) {
-            LOGGER.log(Level.TRACE, "Parses cookie failed, clears the cookie [name=b3log-latke]");
+            LOGGER.log(Level.TRACE, "Parses cookie failed, clears the cookie [name=" + Sessions.COOKIE_NAME + "]");
 
-            final Cookie cookie = new Cookie("b3log-latke", null);
+            final Cookie cookie = new Cookie(Sessions.COOKIE_NAME, null);
             cookie.setMaxAge(0);
             cookie.setPath("/");
 

src/main/resources/latke.properties

@@ -16,7 +16,7 @@
 
 #
 # Description: B3log Latke configurations. Configures the section "Server" carefully.
-# Version: 1.4.3.9, Dec 23, 2015
+# Version: 1.5.3.9, Aug 11, 2017
 # Author: Liang Ding
 #
 
@@ -28,6 +28,10 @@ serverHost=localhost
 # Browser visit port, 80 as usual, THIS IS NOT SERVER LISTEN PORT!
 serverPort=8080
 
+#### Cookie ####
+cookieName=solo
+cookieSecret=Beyond
+
 #### Runtime Mode ####
 runtimeMode=DEVELOPMENT
 #runtimeMode=PRODUCTION