完善shiro配置

guns-admin/src/main/java/com/stylefeng/guns/config/web/ShiroConfig.java

@@ -16,13 +16,11 @@ import org.apache.shiro.web.servlet.ShiroHttpSession;
 import org.apache.shiro.web.servlet.SimpleCookie;
 import org.apache.shiro.web.session.mgt.DefaultWebSessionManager;
 import org.apache.shiro.web.session.mgt.ServletContainerSessionManager;
-import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;
 import org.springframework.beans.factory.config.MethodInvokingFactoryBean;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
 import org.springframework.cache.ehcache.EhCacheManagerFactoryBean;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
-import org.springframework.context.annotation.DependsOn;
 
 import java.util.LinkedHashMap;
 import java.util.Map;
@@ -167,7 +165,9 @@ public class ShiroConfig {
     }
 
     /**
-     * 保证实现了Shiro内部lifecycle函数的bean执行
+     * Shiro生命周期处理器:
+     * 用于在实现了Initializable接口的Shiro bean初始化时调用Initializable接口回调(例如:UserRealm)
+     * 在实现了Destroyable接口的Shiro bean销毁时调用 Destroyable接口回调(例如:DefaultSecurityManager)
      */
     @Bean
     public LifecycleBeanPostProcessor lifecycleBeanPostProcessor() {
@@ -178,12 +178,6 @@ public class ShiroConfig {
      * 启用shrio授权注解拦截方式，AOP式方法级权限检查
      */
     @Bean
-    @DependsOn(value = "lifecycleBeanPostProcessor") //依赖其他bean的初始化
-    public DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator() {
-        return new DefaultAdvisorAutoProxyCreator();
-    }
-
-    @Bean
     public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(DefaultWebSecurityManager securityManager) {
         AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor =
                 new AuthorizationAttributeSourceAdvisor();

guns-admin/src/main/java/com/stylefeng/guns/modular/system/controller/UserMgrController.java

@@ -78,6 +78,7 @@ public class UserMgrController extends BaseController {
     /**
      * 跳转到角色分配页面
      */
+    //@RequiresPermissions("/mgr/role_assign")  //利用shiro自带的权限检查
     @Permission
     @RequestMapping("/role_assign/{userId}")
     public String roleAssign(@PathVariable Integer userId, Model model) {
@@ -162,10 +163,10 @@ public class UserMgrController extends BaseController {
     @Permission
     @ResponseBody
     public Object list(@RequestParam(required = false) String name, @RequestParam(required = false) String beginTime, @RequestParam(required = false) String endTime, @RequestParam(required = false) Integer deptid) {
-        if(ShiroKit.isAdmin()){
+        if (ShiroKit.isAdmin()) {
             List<Map<String, Object>> users = managerDao.selectUsers(null, name, beginTime, endTime, deptid);
             return new UserWarpper(users).warp();
-        }else{
+        } else {
             DataScope dataScope = new DataScope(ShiroKit.getDeptDataScope());
             List<Map<String, Object>> users = managerDao.selectUsers(dataScope, name, beginTime, endTime, deptid);
             return new UserWarpper(users).warp();
@@ -355,7 +356,7 @@ public class UserMgrController extends BaseController {
      * 判断当前登录的用户是否有操作这个用户的权限
      */
     private void assertAuth(Integer userId) {
-        if(ShiroKit.isAdmin()){
+        if (ShiroKit.isAdmin()) {
             return;
         }
         List<Integer> deptDataScope = ShiroKit.getDeptDataScope();

guns-admin/src/main/resources/application.yml

@@ -49,6 +49,8 @@ spring:
       enabled: false #是否开启开发者工具（true/false）
       additional-paths: src/main/java
       exclude: static/**,WEB-INF/view/**
+  aop:
+    proxy-target-class: true #false为启用jdk默认动态代理,true为cglib动态代理
 
 ###################  mybatis-plus配置  ###################
 mybatis-plus: