互金公司为了应付三级等保，给jumpserver添加二次短信验证码
后端代码：
@defend_attack
def Sendmessage(request):
# phonenumber= request.POST.get('phone')
username=request.POST.get('username')
phonenumber=get_object(User, username=username).phone
verifyCode = str(random.randint(100000, 999999))
conn = redis.StrictRedis(host=redis_host, password=redis_pass, port=redis_port)
pipe = conn.pipeline()
pipe.set("phone%s" % phonenumber, verifyCode)
pipe.expire("phone%s" % phonenumber, 60)
pipe.execute()
print verifyCode
#这里调用你的短信api
data = {'message': '短信已发送'}
return HttpResponse(json.dumps(data), content_type='application/json')
@defend_attack
def Login(request):
"""登录界面"""
error = ''
conn = redis.StrictRedis(host=redis_host, password=redis_pass, port=redis_port)
if request.user.is_authenticated():
return HttpResponseRedirect(reverse('index'))
if request.method == 'GET':
return render_to_response('login.html')
else:
username = request.POST.get('username')
password = request.POST.get('password')
phonenumber = get_object(User, username=username).phone
smscode = request.POST.get('smscode')
phoneinredis=conn.get("phone%s" % phonenumber)
print "phone%s" % phonenumber
print smscode
print phoneinredis
if username and password and smscode==phoneinredis:
user = authenticate(username=username, password=password)
if user is not None:
if user.is_active:
login(request, user)
# c = {}
# c.update(csrf(request))
# request.session['csrf_token'] = str(c.get('csrf_token'))
# user_filter = User.objects.filter(username=username)
# if user_filter:
# user = user_filter[0]
# if PyCrypt.md5_crypt(password) == user.password:
# request.session['user_id'] = user.id
# user_filter.update(last_login=datetime.datetime.now())
if user.role == 'SU':
request.session['role_id'] = 2
elif user.role == 'GA':
request.session['role_id'] = 1
else:
request.session['role_id'] = 0
return HttpResponseRedirect(request.session.get('pre_url', '/'))
# response.set_cookie('username', username, expires=604800)
# response.set_cookie('seed', PyCrypt.md5_crypt(password), expires=604800)
# return response
else:
error = '用户未激活'
else:
error = '用户名或密码错误'
else:
error = '用户名或密码错误'
return render_to_response('login.html', {'error': error})
前端代码：
var countdown=60;
function sendemail(){
var obj = $("#btn");
settime(obj);
$.ajax({
url:"/Sendmessage/",
type:"POST",
dataType:"json",
data:{
username:$('#username').val()
},
success:function(data){
alert(data["message"])
},
error:function() {
alert("error13")
}
});
}
function settime(obj) { //发送验证码倒计时
if (countdown == 0) {
obj.attr('disabled',false);
//obj.removeattr("disabled");
obj.val("免费获取验证码");
countdown = 60;
return;
} else {
obj.attr('disabled',true);
obj.val("重新发送(" + countdown + ")");
countdown--;
}
setTimeout(function() {
settime(obj) }
,1000)
}
效果：
