升级 shiro 1.8.0 其它版本也可参照此提交进行升级

modules/core/src/main/java/com/jeesite/modules/config/ShiroConfig.java

@@ -13,6 +13,7 @@ import org.apache.shiro.cas.CasSubjectFactory;
 import org.apache.shiro.realm.Realm;
 import org.apache.shiro.spring.LifecycleBeanPostProcessor;
 import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
+import org.apache.shiro.web.filter.InvalidRequestFilter;
 import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
 import org.springframework.boot.web.servlet.FilterRegistrationBean;
@@ -108,6 +109,15 @@ public class ShiroConfig {
 	private UserFilter shiroUserFilter() {
 		return new UserFilter();
 	}
+	
+	/**
+	 * 非法请求过滤器
+	 */
+	private InvalidRequestFilter invalidRequestFilter() {
+		InvalidRequestFilter bean = new InvalidRequestFilter();
+		bean.setBlockNonAscii(false);
+		return bean;
+	}
 
 	/**
 	 * Shiro认证过滤器
@@ -126,6 +136,7 @@ public class ShiroConfig {
 		filters.put("perms", shiroPermsFilter());
 		filters.put("roles", shiroRolesFilter());
 		filters.put("user", shiroUserFilter());
+		filters.put("invalidRequest", invalidRequestFilter());
 		FilterChainDefinitionMap chains = new FilterChainDefinitionMap();
 		chains.setFilterChainDefinitions(Global.getProperty("shiro.filterChainDefinitions"));
 		chains.setDefaultFilterChainDefinitions(Global.getProperty("shiro.defaultFilterChainDefinitions"));

parent/pom.xml

@@ -34,7 +34,7 @@
 		<mybatis-spring.version>1.3.1</mybatis-spring.version>
 		<jsqlparser.version>1.1</jsqlparser.version>
 		<druid.version>1.1.10</druid.version>
-		<shiro.version>1.4.2</shiro.version>
+		<shiro.version>1.8.0</shiro.version>
 		<beetl.version>2.7-SNAPSHOT</beetl.version>
 		<ehcache-web.version>2.0.4</ehcache-web.version>
 		<quartz.version>2.2.3</quartz.version>