<?xml version="1.0" encoding="UTF-8"?>

 <beans:beans xmlns="http://www.springframework.org/schema/security"

     xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

     xsi:schemaLocation="http://www.springframework.org/schema/beans

            http://www.springframework.org/schema/beans/spring-beans-3.0.xsd

            http://www.springframework.org/schema/security

            http://www.springframework.org/schema/security/spring-security.xsd">

     <beans:import resource="spring-security.xml" />

     <beans:import resource="spring-mybatis.xml" />

 </beans:beans>  

 <?xml version="1.0" encoding="UTF-8"?>

 <beans xmlns="http://www.springframework.org/schema/beans"

     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:p="http://www.springframework.org/schema/p"

     xmlns:mvc="http://www.springframework.org/schema/mvc" xmlns:context="http://www.springframework.org/schema/context"

     xmlns:util="http://www.springframework.org/schema/util"

     xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.0.xsd

              http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.0.xsd

              http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-4.0.xsd

              http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-4.0.xsd">

     <!-- DispatcherServlet Context: defines this servlet's request-processing infrastructure -->

     <bean class="org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter">

         <property name="synchronizeOnSession" value="true" />

         <property name="customArgumentResolvers">

             <list>

                 <bean class="wyp.filterexpression.EntityResolver" />

             </list>

         </property>

     </bean>

     <!-- http://hecks.iteye.com/blog/2165606 Spring MVC 3.2中@ResponseBody返回乱码的完美解决方案 -->

     <mvc:annotation-driven>

         <mvc:message-converters>

             <!-- default StringHttpMessageConverter, solve encoding problem -->

             <bean class="org.springframework.http.converter.StringHttpMessageConverter">

                 <constructor-arg value="UTF-8" />

                 <property name="writeAcceptCharset" value="false" />

             </bean>

         </mvc:message-converters>

         <!-- http://shengwangi.blogspot.com/2015/09/asynchronous-spring-mvc-hello-world.html -->

         <mvc:async-support default-timeout="" task-executor="taskExecutor"/>

     </mvc:annotation-driven>

     <!-- modify the parameters of thread pool -->

     <bean id="taskExecutor" class="org.springframework.scheduling.concurrent.ThreadPoolTaskExecutor">

         <property name="corePoolSize" value=""/>

         <property name="maxPoolSize" value=""/>

         <property name="queueCapacity" value=""/>

         <property name="keepAliveSeconds" value=""/>

       </bean>

     <mvc:default-servlet-handler default-servlet-name="default" />

     <!-- Handles HTTP GET requests for /resources/** by efficiently serving up static resources in the ${webappRoot}/resources directory -->

     <mvc:resources mapping="/Scripts/**" location="/Scripts/" />

     <mvc:resources mapping="/Content/**" location="/Content/" />

     <!-- 配置velocity引擎 -->

     <bean id="velocityconfig"

         class="org.springframework.web.servlet.view.velocity.VelocityConfigurer">

         <!-- 模板存放的路徑 -->

         <property name="resourceLoaderPath" value="/" />

         <!-- Velocity配置文件 -->

         <property name="configLocation" value="classpath:velocity.properties" />

     </bean>

     <!-- 对模型视图名称的解析，即在模型视图名称添加前后缀 -->

     <bean id="jspconfig" class="org.springframework.web.servlet.view.InternalResourceViewResolver">

         <property name="prefix">

             <value>/WEB-INF/jsp/</value>

         </property>

         <property name="suffix" value=".jsp" />

         <property name="order" value="2" />

     </bean>

     <!-- 配置Velocity视图的显示 -->

     <bean id="vmconfig" class="org.springframework.web.servlet.view.velocity.VelocityLayoutViewResolver">

         <property name="prefix" value="/WEB-INF/vm/" />

         <property name="suffix" value=".vm" />

         <!-- 视图文件的后缀名 -->

         <!-- 视图文件的前綴，即存放的路徑 -->

         <property name="toolboxConfigLocation" value="/WEB-INF/toolbox.xml" />

         <!--toolbox配置文件路徑 -->

         <property name="dateToolAttribute" value="date" />

         <!--日期函數名稱 -->

         <property name="numberToolAttribute" value="number" />

         <!--數字函數名稱 -->

         <property name="contentType" value="text/html;charset=UTF-8" />

         <property name="exposeSpringMacroHelpers" value="true" />

         <!--是否使用spring對宏定義的支持 -->

         <property name="exposeRequestAttributes" value="true" />

         <!--是否開放request屬性 -->

         <property name="requestContextAttribute" value="rc" />

         <!--request屬性引用名稱 -->

         <property name="layoutUrl" value="/WEB-INF/vm/Shared/_Layout.vm" />

         <!--指定默認layout文件 -->

         <property name="order" value="1" />

     </bean>

     <!-- 视图解析器，根据视图的名称new ModelAndView(name)，在配置文件查找对应的bean配置 -->

     <bean id="beanconfig" class="org.springframework.web.servlet.view.BeanNameViewResolver">

         <property name="order" value="0" />

     </bean>

     <!-- 配置文件上传，如果没有使用文件上传可以不用配置，当然如果不配，那么配置文件中也不必引入上传组件包 -->

     <bean id="multipartResolver"

         class="org.springframework.web.multipart.commons.CommonsMultipartResolver">

         <!-- 默认编码 -->

         <property name="defaultEncoding" value="utf-8" />

         <!-- 文件大小最大值 -->

         <property name="maxUploadSize" value="10485760000" />

         <!-- 内存中的最大值 -->

         <property name="maxInMemorySize" value="40960" />

     </bean>

     <!-- 下面就是自定义异常处理的handler和view -->

     <bean id="exceptionHandler" class="wyp.ssm.demo.ExceptionResolver" />

     <bean id="exceptionView" class="wyp.ssm.demo.ExceptionView" />

     <!-- 扫描spring mvc 的 controller 所在的默认包名 -->

     <context:component-scan base-package="wyp.ssm.demo" />

 </beans>

 <?xml version="1.0" encoding="UTF-8"?>

 <beans xmlns="http://www.springframework.org/schema/beans"

     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

     xmlns:context="http://www.springframework.org/schema/context"

     xsi:schemaLocation="http://www.springframework.org/schema/beans

                             http://www.springframework.org/schema/beans/spring-beans-3.1.xsd

                             http://www.springframework.org/schema/context

                             http://www.springframework.org/schema/context/spring-context-3.1.xsd

                             http://www.springframework.org/schema/mvc

                             http://www.springframework.org/schema/mvc/spring-mvc-4.0.xsd">

     <!-- 自动扫描 -->

     <context:component-scan base-package="wyp.ssm.demo.db" />

     <!-- 引入配置文件 -->

     <bean id="propertyConfigurer" class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer">

         <property name="location" value="classpath:jdbc.properties" />

     </bean>

     <bean id="dataSource" class="org.apache.commons.dbcp.BasicDataSource" destroy-method="close">

         <property name="driverClassName" value="${driver}" />

         <property name="url" value="${url}" />

         <property name="username" value="${username}" />

         <property name="password" value="${password}" />

         <!-- 初始化连接大小 -->

         <property name="initialSize" value="${initialSize}"></property>

         <!-- 连接池最大数量 -->

         <property name="maxActive" value="${maxActive}"></property>

         <!-- 连接池最大空闲 -->

         <property name="maxIdle" value="${maxIdle}"></property>

         <!-- 连接池最小空闲 -->

         <property name="minIdle" value="${minIdle}"></property>

         <!-- 获取连接最大等待时间 -->

         <property name="maxWait" value="${maxWait}"></property>

     </bean>

     <!-- spring和MyBatis完美整合，不需要mybatis的配置映射文件 -->

     <bean id="sqlSessionFactory" class="org.mybatis.spring.SqlSessionFactoryBean">

         <property name="dataSource" ref="dataSource" />

         <!-- 自动扫描mapping.xml文件 -->

         <property name="mapperLocations" value="classpath:wyp/ssm/demo/db/xml/*.xml"></property>

         <property name="typeAliasesPackage" value="wyp.ssm.demo.db.pojo" />

     </bean>

     <!-- DAO接口所在包名，Spring会自动查找其下的类 -->

     <bean class="org.mybatis.spring.mapper.MapperScannerConfigurer">

         <property name="basePackage" value="wyp.ssm.demo.db.mapper" />

         <property name="sqlSessionFactoryBeanName" value="sqlSessionFactory"></property>

     </bean>

     <!-- (事务管理)transaction manager, use JtaTransactionManager for global tx -->

     <bean id="transactionManager" class="org.springframework.jdbc.datasource.DataSourceTransactionManager">

         <property name="dataSource" ref="dataSource" />

     </bean>

 </beans>  

 <?xml version="1.0" encoding="UTF-8"?>

 <beans:beans xmlns="http://www.springframework.org/schema/security"

     xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

     xsi:schemaLocation="http://www.springframework.org/schema/beans

            http://www.springframework.org/schema/beans/spring-beans-3.0.xsd

            http://www.springframework.org/schema/security

            http://www.springframework.org/schema/security/spring-security.xsd">

     <http pattern="/Scripts/**" security="none" />

     <http pattern="/Content/**" security="none" />

     <http pattern="/Account/Auth/Login" security="none" />

     <http entry-point-ref="authenticationEntryPoint">

         <!-- 替换默认的LoginFilter -->

         <custom-filter ref="customLoginFilter" position="FORM_LOGIN_FILTER" />

         <!-- 替换默认的LogoutFilter -->

         <custom-filter ref="customLogoutFilter" position="LOGOUT_FILTER" />

         <!-- 增加一个filter，这点与Acegi是不一样的，不能修改默认的filter了， 这个filter位于FILTER_SECURITY_INTERCEPTOR之前 -->

         <custom-filter ref="customSecurityFilter" before="FILTER_SECURITY_INTERCEPTOR" />

     </http>

     <beans:bean id="authenticationEntryPoint"

         class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">

         <beans:constructor-arg name="loginFormUrl"

             value="/Account/Auth/Login" />

     </beans:bean>

     <!-- class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter"

         默认登录验证方式 -->

     <beans:bean id="customLoginFilter"

         class="wyp.ssm.demo._.UsernamePasswordAuthenticationFilterExtend">

         <!-- 校验登录是否有效的虚拟url -->

         <beans:property name="requiresAuthenticationRequestMatcher"

             ref="customLoginRequestMatcher" />

         <beans:property name="authenticationManager" ref="UserAuthenticationManager" />

         <beans:property name="usernameParameter" value="LoginAccount" />

         <beans:property name="passwordParameter" value="LoginPassword" />

         <beans:property name="authenticationSuccessHandler">

             <!-- 自定义登录成功后的处理handler -->

             <beans:bean

                 class="org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler">

                 <!-- 登录成功后的默认url -->

                 <beans:property name="defaultTargetUrl" value="/Home/Index" />

             </beans:bean>

         </beans:property>

         <beans:property name="authenticationFailureHandler">

             <beans:bean

                 class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler">

                 <!-- 登录失败后的默认Url -->

                 <beans:property name="defaultFailureUrl" value="/Account/Auth/Login" />

             </beans:bean>

         </beans:property>

     </beans:bean>

     <beans:bean id="customLoginRequestMatcher"

         class="org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter$FilterProcessUrlRequestMatcher">

         <beans:constructor-arg value="/Account/Auth/LoginDo/" />

     </beans:bean>

     <beans:bean id="customLogoutFilter"

         class="org.springframework.security.web.authentication.logout.LogoutFilter">

         <!-- 处理退出的虚拟url -->

         <beans:property name="logoutRequestMatcher" ref="customLogoutRequestMatcher" />

         <!-- 退出处理成功后的默认显示url -->

         <beans:constructor-arg index=""

             value="/Account/Auth/Login" />

         <beans:constructor-arg index="">

             <!-- 退出成功后的handler列表 -->

             <beans:array>

                 <beans:bean id="securityContextLogoutHandler"

                     class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler" />

             </beans:array>

         </beans:constructor-arg>

     </beans:bean>

     <beans:bean id="customLogoutRequestMatcher"

         class="org.springframework.security.web.authentication.logout.LogoutFilter$FilterProcessUrlRequestMatcher">

         <beans:constructor-arg value="/Account/Auth/Logout/" />

     </beans:bean>

     <!-- 一个自定义的filter，必须包含authenticationManager,accessDecisionManager,securityMetadataSource三个属性，

         我们的所有控制将在这三个类中实现，解释详见具体配置 -->

     <beans:bean id="customSecurityFilter"

         class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">

         <!-- 针对当前系统里所有可以访问的资源进行授权操作 -->

         <beans:property name="securityMetadataSource" ref="UrlSecurityMetadataSource" />

         <!-- 针对登录用户进行授权，同时验证登录用户名和密码是否合法 -->

         <beans:property name="authenticationManager" ref="UserAuthenticationManager" />

         <!-- 访问决策器，决定某个用户是否有足够的权限去访问某个资源 -->

         <beans:property name="accessDecisionManager" ref="UserUrlAccessDecisionManager" />

     </beans:bean>

     <!-- 资源数据定义，将所有的资源和权限对应关系建立起来，即定义某一资源可以被哪些角色访问 -->

     <beans:bean id="UrlSecurityMetadataSource" init-method="loadResourceDefine"

         class="wyp.ssm.demo._.FilterInvocationSecurityMetadataSourceImpl">

     </beans:bean>

     <!-- 验证配置 ， 认证管理器，实现用户认证的入口，主要实现UserDetailsService接口即可 -->

     <authentication-manager alias="UserAuthenticationManager">

         <authentication-provider user-service-ref="UserNameUserDetailService">

             <password-encoder ref="UserPasswordEncoder">

                 <salt-source user-property="salt"/>

             </password-encoder>

         </authentication-provider>

     </authentication-manager>

     <!-- 通过登录名称从数据库中得到当前登录用户的信息和他所拥有的权限 -->

     <beans:bean id="UserNameUserDetailService" class="wyp.ssm.demo._.UserDetailServiceImpl"></beans:bean>

     <!-- 通过登录名称从数据库中得到当前登录用户的信息验证登录密码是否正确 -->

     <beans:bean id="UserPasswordEncoder"

         class="wyp.ssm.demo._.MessageDigestPasswordEncoderImpl">

         <beans:constructor-arg name="algorithm" value="md5"></beans:constructor-arg>

     </beans:bean>

     <!-- 用户访问URL时验证权限 -->

     <beans:bean id="UserUrlAccessDecisionManager"

         class="wyp.ssm.demo._.AccessDecisionManagerImpl"></beans:bean>

     <!-- 免登陆过滤器 -->

 </beans:beans>

 driver=com.mysql.jdbc.Driver

 url=jdbc:mysql://192.168.7.55:13306/program_shopcart?useUnicode=true&characterEncoding=utf8

 username=root

 password=qwer1234

 #定义初始连接数

 initialSize=

 #定义最大连接数

 maxActive=

 #定义最大空闲

 maxIdle=

 #定义最小空闲

 minIdle=

 #定义最长等待时间

 maxWait=

 <?xml version="1.0" encoding="UTF-8"?>

 <web-app version="3.0" xmlns="http://java.sun.com/xml/ns/javaee"

     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

     xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd">

     <!-- The definition of the Root Spring Container shared by all Servlets and Filters -->

     <context-param>

         <param-name>contextConfigLocation</param-name>

         <param-value>classpath:spring-config.xml</param-value>

     </context-param>

     <!-- Spring监听器 -->

     <listener>

         <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>

     </listener>

     <!-- 防止Spring内存溢出监听器 -->

     <listener>

         <listener-class>org.springframework.web.util.IntrospectorCleanupListener</listener-class>

     </listener>

     <!-- Processes application requests -->

     <servlet>

         <servlet-name>springMVCServlet</servlet-name>

         <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>

         <init-param>

             <param-name>contextConfigLocation</param-name>

             <!-- 修改spring mvc 表示层默认配置文件的路径 -->

             <param-value>classpath:spring-mvc.xml</param-value>

         </init-param>

         <load-on-startup></load-on-startup>

         <async-supported>true</async-supported>

     </servlet>

     <!-- url-pattern=/*必须加* -->

     <servlet-mapping>

         <servlet-name>springMVCServlet</servlet-name>

         <url-pattern>/*</url-pattern>

     </servlet-mapping>

     <!-- spring mvc security config -->

     <filter>

         <filter-name>springSecurityFilterChain</filter-name>

         <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>

         <async-supported>true</async-supported>

     </filter>

     <filter-mapping>

         <filter-name>springSecurityFilterChain</filter-name>

         <url-pattern>/*</url-pattern>

     </filter-mapping>