待修改文件
/usr/share/nginx/html/Application/User/Controller/LoginController.class.php
token_url中corpid为企业id
corpsecret为应用私钥，在应用管理中选择对应应用可见Secret
<?php
namespace User\Controller;
use Think\Controller;
use Think\Log;
/**
* @Author: Martin Zhou
* @Version: 1.0.1
* @Copyright Tencent Security Response Center (TSRC)
* @Project https://security.tencent.com/index.php/xsrc
*/
class LoginController extends Controller
{
/**
* 登陆页面
**/
public function index()
{
$tmodel = M('setting');
$title = $tmodel->where('id=1')->select();
$this->assign('title', $title);
$this->display();
}
/**
* 登陆验证
**/
public function login()
{
$code = $_GET["code"];
$uid = $this->get_uid_by_token_and_code($code);
$uinfo = $this->get_user_by_id($uid);
//用户信息
$name = $uinfo->name;
$avatar = $uinfo->avatar;
$username = $uinfo->userid;
$email = $uinfo->email;
$member = M('member');
$user = $member->where(array('email' => $email))->find();
if (empty($user)){
$data['salt'] = "";
$data['pid'] = "";
$chars = 'abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ';
$pchars = '0123456789';
for($num=0;$num<8;$num++){
$RandNum = rand(0,strlen($chars)-1);
$data['salt'] .= $chars[$RandNum];
}
for($num=0;$num<32;$num++){
$RandNum = rand(0,strlen($pchars)-1);
$data['pid'] .= $pchars[$RandNum];
}
$data['username'] = $username;
$data['email']= $email;
$data['password'] = "11111111";
$data['password'] = md5(md5(md5($data['salt']).md5($data['password'])."SR")."CMS"); //“SR”和“CMS”可修改
$data['create_at']=time();
$model = M("Member");
if ($model->field('username,email,pid,salt,password,create_at')->data($data)->add()) {
$user = $model->where(array('username'=>$data['username']))->find();
$date =array(
'id' => $user['id'],
'update_at' => time(),
'login_ip' => get_client_ip(),
);
// if($model->save($date)){
// $this->redirect('index/index');
// }
}
$user = $member->where(array('email' => $email))->find();
}
//不为空, 登录
$token = md5(md5($user['email'] . time()) . time());
$data = array(
'id' => $user['id'],
'update_at' => time(),
'login_ip' => get_client_ip(),
'token' => $token
//2017-07-02 fix bug: token can't be inserted into databease. By. yuyang
);
//登陆成功
$message_num = M('message')->where(array('userid' => $user['id'], 'read' => 0))->count();
session('token', $token);
session('userId', $user['id']);
session('username', $user['username']);
session('avatar', $user['avatar']);
session('mnum', $message_num);
redirect('./index.php');
// if (!IS_POST) {
// $this->error("非法请求");
// }
// $member = M('member');
// $email = I('email', '', 'email');
// $password = I('password');
// $code = I('verify', '', 'strtolower');
//
//
// echo $member." ";
// echo $email." ";
// echo $password." ";
// echo $code;
// if (!($this->check_verify($code))) {
// session('userId', null);
// session('username', null);
// $this->error('验证码错误', U('Login/index'));
// }
//
// $user = $member->where(array('email' => $email))->find();
//
// if ($user['password'] != md5(md5(md5($user['salt']) . md5($password) . "SR") . "CMS")) {
// $this->error('账户或密码错误', U('Login/index'));
// }
//
// if ($user['status'] == 0) {
// $this->error('账号被删除或禁用，请联系管理员 :(');
// }
// $token = md5(md5($user['email'] . time()) . time());
// //更新登陆信息
// $data = array(
// 'id' => $user['id'],
// 'update_at' => time(),
// 'login_ip' => get_client_ip(),
// 'token' => $token
// //2017-07-02 fix bug: token can't be inserted into databease. By. yuyang
// );
// //登陆成功
// $message_num = M('message')->where(array('userid' => $user['id'], 'read' => 0))->count();
//
// if ($member->save($data)) {
// /**session('token',$token);
// * $this->success("请先完成验证",U('Login/svalid?email=').$user['email']);
// **/
// session('token', $token);
// session('userId', $user['id']);
// session('username', $user['username']);
// session('avatar', $user['avatar']);
// session('mnum', $message_num);
// redirect('./index.php');
// }
}
/**
* 企业微信登录验证
*/
public function wxlogin()
{
$code = $_GET["code"];
$uid = $this->get_uid_by_token_and_code($code);
$uinfo = $this->get_user_by_id($uid);
//用户信息
$name = $uinfo->name;
$avatar = $uinfo->avatar;
$email = $uinfo->email;
session('username', $name);
session('avatar', $avatar);
redirect('./index.php');
}
public function get_uid_by_token_and_code($code)
{
//{}&code={}
$access_token = $this->get_access_token();
$uid_url = "https://qyapi.weixin.qq.com/cgi-bin/user/getuserinfo?access_token=" . $access_token . "&code=" . $code;
$re = file_get_contents($uid_url);
$re_json = json_decode($re);
$error_code = $re_json->errcode;
if ($error_code == 0) {
return $re_json->UserId;
}
}
public function get_user_by_id($uid)
{
$access_token = session("access_token");
if (empty($access_token)) {
$access_token = $this->get_access_token();
// return $re_json;
}
$uinfo_url = "https://qyapi.weixin.qq.com/cgi-bin/user/get?access_token=" . $access_token . "&userid=" . $uid;
$re = file_get_contents($uinfo_url);
$re_json = json_decode($re);
return $re_json;
}
public function get_access_token()
{
//修改corpId和secret
//测试app
// $token_url = "https://qyapi.weixin.qq.com/cgi-bin/gettoken?corpid=ww8c&corpsecret=FLPVbwE1Bc";
//生产app
$token_url = "https://qyapi.weixin.qq.com/cgi-bin/gettoken?corpid=wx01&corpsecret=5u8DV3mM";
$re = file_get_contents($token_url);
$re_json = json_decode($re);
$error_code = $re_json->errcode;
if ($error_code == 0) {
$access_token = $re_json->access_token;
session("access_token", $access_token);
return $access_token;
}
}
//验证码
public function verify()
{
ob_clean();
$Verify = new \Think\Verify();
$Verify->codeSet = '123456789abcdefg';
$Verify->fontSize = 16;
$Verify->length = 4;
$Verify->entry();
}
protected function check_verify($code)
{
$verify = new \Think\Verify();
return $verify->check($code);
}
//退出登录
public function logout()
{
session('userId', null);
session('username', null);
session('avatar', null);
session('mnum', null);
redirect(U('Login/index'));
}
}
待修改文件
/usr/share/nginx/html/Application/User/View/Login/index.html
1、根据实际情况修改window.WwLogin，其中
"appid"为企业id
"agentid"为应用id，在应用管理中选择对应应用可见AgentId
"redirect_uri"为登录页面地址，根据实际情况填写
2、若"redirect_uri"为https请求，则https://rescdn.qqmail.com/node/ww/wwopenmng/js/sso/wwLogin-1.0.0.js为https，若为http，则为http
<!DOCTYPE html>
<html class=" js no-touch csstransforms csstransforms3d svg" lang="">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>Tencent xSRC - 企业安全应急响应中心</title>
<meta name="description" content="">
<meta name="viewport" content="width=device-width, user-scalable=no, initial-scale=1, maximum-scale=1">
<link rel="stylesheet" href="__PUBLIC__/Admin/app.user.css">
<style type="text/css">.cf-hidden {
display: none;
}
.cf-invisible {
visibility: hidden;
}</style>
</head>
<body class="page-loaded" style="font-family:微软雅黑;">
<div class="pageload" style="display: none;">
<div class="pageload-inner">
<div class="sk-rotating-plane"></div>
</div>
</div>
<div class="app signin v2 usersession">
<div class="session-wrapper">
<div class="session-carousel slide" data-ride="carousel" data-interval="3000">
<div class="carousel-inner" role="listbox">
<div class="item active"
style="background-image:url(__PUBLIC__/Admin/userpage.jpg);background-size:cover;background-repeat: no-repeat;background-position: 50% 50%;">
</div>
</div>
</div>
</div>
<div class="card bg-white no-border">
<div class="card-block" style="padding:20% 5% 5% 5%;">
<form role="form" class="form-layout" action="{:U('login/login')}" method="post">
<!-- <div class="text-center m-b">-->
<!-- <img src="__PUBLIC__/Admin/logo.png" style="width:60%;height:60%"></img>-->
<!-- <!–<p>携手共建安全生态</p>–>-->
<!-- </div>-->
<!-- <div class="form-inputs p-b">-->
<!-- <label class="text-uppercase">邮箱（账户名）</label>-->
<!-- <input type="text" class="form-control input-lg" placeholder="邮箱" name="email"/>-->
<!-- <label class="text-uppercase">密码</label>-->
<!-- <input type="password" class="form-control input-lg" placeholder="密码" name="password"/>-->
<!-- <label class="text-uppercase">验证码</label>-->
<!-- <div style="float:left;width:55%">-->
<!-- <input type="text" name="verify" class="form-control input-lg" id="exampleInputCode"-->
<!-- placeholder="验证码">-->
<!-- </div>-->
<!-- <div style="float:right;">-->
<!-- <a href="javascript:void(0)"><img class="verify" src="{:U('login/verify')}" alt="点击刷新"/></a>-->
<!-- </div>-->
<!-- <div style="float:left;width:100%">-->
<!-- <p><a href="{:U('forget/index')}">忘记密码 | </a><a href="{:U('reg/index')}">账户注册</a></p>-->
<!-- </div>-->
<!-- </div>-->
<!-- <button class="btn btn-primary btn-block btn-lg m-b" type="submit">立即登录</button>-->
<div id="wxCode"></div>
<!--<div class="divider">
<span>或</span>
</div>
<a class="btn btn-block no-bg btn-lg m-b" href="{:U('reg/index')}">立即注册</a>
</div>-->
</form>
</div>
</div>
</div>
</div>
<script src="__PUBLIC__/Admin/app.min.js"></script>
<div class="bg-default"></div>
<div class="bg-primary"></div>
<div class="bg-success"></div>
<div class="bg-warning"></div>
<div class="bg-danger"></div>
<div class="bg-info"></div>
<div class="bg-white"></div>
<div class="bg-dark"></div>
</body>
<script src="__STATIC__/js/jquery-1.10.2.js"></script>
<script src="https://rescdn.qqmail.com/node/ww/wwopenmng/js/sso/wwLogin-1.0.0.js"></script>
<script>
//生产企业微信登录配置
window.WwLogin({
"id" : "wxCode",
"appid" : "wx01",
"agentid" : "108",
"redirect_uri" :"https%3a%2f%2fsec.wuev.cn%2fxSRC_1.0.1%2fuser.php%3fm%3d%26c%3dlogin%26a%3dlogin",
"state" : "",
"href" : "",
});
</script>
<script>
$(function () {
$(".verify").click(function () {
var src = "{:U('login/verify')}";
var random = Math.floor(Math.random() * (1000 + 1));
$(this).attr("src", src + "&random=" + random);
});
})
</script>
</html>
