fix

virgo.core/src/main/java/com/bosshand/virgo/core/shiro/UserRealm.java

@@ -1,6 +1,10 @@
 package com.bosshand.virgo.core.shiro;
 
+import com.alibaba.druid.util.StringUtils;
+import com.bosshand.virgo.core.model.MgrUser;
+import com.bosshand.virgo.core.service.MgrUserService;
 import com.bosshand.virgo.core.utils.CodeCache;
+import com.bosshand.virgo.exception.Constant;
 import org.apache.shiro.authc.AuthenticationException;
 import org.apache.shiro.authc.AuthenticationInfo;
 import org.apache.shiro.authc.AuthenticationToken;
@@ -13,10 +17,6 @@ import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Component;
 
-import com.alibaba.druid.util.StringUtils;
-import com.bosshand.virgo.core.model.MgrUser;
-import com.bosshand.virgo.core.service.MgrUserService;
-
 @Component
 public class UserRealm extends AuthorizingRealm {
 
@@ -28,6 +28,11 @@ public class UserRealm extends AuthorizingRealm {
 	@Override
 	protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken)throws AuthenticationException {
 		logger.warn("Identity Authentication");
+
+		if(authenticationToken.getPrincipal() == null){
+			throw new AuthenticationException(Constant.RET_INVALID_CODE);
+		}
+
 		String phone = authenticationToken.getPrincipal().toString();
 		
 		if (StringUtils.isEmpty(phone)) {

virgo.core/src/main/java/com/bosshand/virgo/core/shiro/VirgoAuthenticationFilter.java

@@ -163,7 +163,10 @@ public class VirgoAuthenticationFilter extends AuthenticatingFilter {
     protected boolean onLoginFailure(AuthenticationToken token, AuthenticationException e, ServletRequest request, ServletResponse response) {
     	log.error("failed to login.", e);
     	WebUtils.toHttp(response).setStatus(HttpStatus.OK.value());
-    	Response r = Response.fail(Constant.CODE_AUTH_FAILED, Constant.RET_INVALID_PASSWORD);
+		Response r = Response.fail(Constant.CODE_AUTH_FAILED, Constant.RET_INVALID_PASSWORD);
+    	if(Constant.RET_INVALID_CODE.equals(e.getMessage())){
+			r = Response.fail(Constant.CODE_AUTH_FAILED, Constant.RET_INVALID_CODE);
+		}
     	try {
 			WebUtils.toHttp(response).getWriter().write(JSON.toJSONString(r));
 		} catch (IOException e1) {