func (a Auth) DoLogin(email, pwd, validationCode, captchaId string) revel.Result {
	log.Println("email:", email, "validationCode:", validationCode, "captchaId:", captchaId)
	ok := app.NewOk()
	ok.Ok = a.Validation.Required(captcha.VerifyString(captchaId, validationCode)).Ok
	if !ok.Ok {
		ok.Msg = "captcha"
		return a.RenderJson(ok)
	}
	ok.Ok = a.Validation.Required(email).Ok
	if !ok.Ok {
		ok.Msg = "email"
		return a.RenderJson(ok)
	}
	ok.Ok = a.Validation.Email(email).Ok
	if !ok.Ok {
		ok.Msg = "email"
		return a.RenderJson(ok)
	}

	if !a.checkAuth() {
		ok.Msg = "login"
		ok.Ok = false
	} else {
		ok.Next = app.NextJson{"href", "/index"}
		a.Session["user"] = email
		if email == "[email protected]" {
			ok.Msg = "admin"
		}
	}

	log.Println("set register session:", a.Session, "with resp:", ok)
	return a.RenderJson(ok)
}

// 校验验证码
func (this *Captcha) Check(req *http.Request, res http.ResponseWriter) {
	req.ParseForm()
	if ok := captcha.VerifyString(req.Form.Get(conf.ConfInstance.CaptchaIdName), req.Form.Get(conf.ConfInstance.CaptchaName)); !ok {
		res.WriteHeader(400)
		res.Write([]byte("验证码错误"))
	}
}

// 用户登录表单提交
func (this *UserController) LoginAction() {
	flash := beego.NewFlash()
	user := &models.User{}
	err := this.ParseForm(user)

	if err != nil {
		beego.Error("用户登录失败:" + err.Error())
		flash.Error("用户登录失败!")
		flash.Store(&this.Controller)
		this.Redirect("/login", 302) //登录失败,重定向到登录页
		return
	}

	user.Password = models.MD5(user.Password) //将密码以MD5加密存储
	captchaCode := this.Input().Get("captcha")

	//判断验证码是否正确
	if !captcha.VerifyString(this.GetSession("captchaStr").(string), captchaCode) {
		flash.Error("验证码不正确!")
		flash.Store(&this.Controller)
		this.DelSession("captchaStr") //从session中清空
		this.Redirect("/login", 302)  //验证码不正确,重定向到登录页
		return
	} else {
		isAutoLogin := this.Input().Get("isAutoLogin") == "on" //是否自动登录

		u := models.Login(user) //成功返回user,失败返回nil

		if u != nil {
			maxAge := 0
			if isAutoLogin {
				maxAge = 72 * 24 * 60
			}
			this.Ctx.SetCookie("username", user.Username, maxAge, "/") //设置cookie
			this.Ctx.SetCookie("password", user.Password, maxAge, "/") //设置cookie

			u.Lastlogin = time.Now().Local() //设置最后登录时间
			u.Loginip = this.Ctx.Input.IP()  //获取客户端IP

			if !models.UserModify(u) { //用户登录成功后更新最后登录时间
				beego.Error("更新用户最后登录时间失败" + err.Error())
				flash.Error("更新用户最后登录时间失败!")
				flash.Store(&this.Controller)
			}

			this.SetSession("user", u) //将用户信息存放到Session中
			flash.Notice("用户" + u.Nickname + "登录成功!")
			flash.Store(&this.Controller)
			this.Redirect("/", 302) //登录成功
			return
		} else {
			flash.Error("用户名或密码不正确!")
			flash.Store(&this.Controller)
			this.Redirect("/login", 302) //登录失败,重定向到登录页
			return
		}
	}

}

func processFormHandler(w http.ResponseWriter, r *http.Request) {
	w.Header().Set("Content-Type", "text/html; charset=utf-8")
	if !captcha.VerifyString(r.FormValue("captchaId"), r.FormValue("captchaSolution")) {
		io.WriteString(w, "Wrong captcha solution! No robots allowed!\n")
	} else {
		io.WriteString(w, "Great job, human! You solved the captcha.\n")
	}
	io.WriteString(w, "<br><a href='/'>Try another one</a>")
}

// return true if this session has solved the last captcha given provided solution, otherwise false
func (cs *CaptchaServer) CheckSession(w http.ResponseWriter, r *http.Request, solution string) (bool, error) {
	s, err := cs.store.Get(r, cs.sessionName)
	if err == nil {
		id, ok := s.Values["captcha_id"]
		if ok {
			return captcha.VerifyString(id.(string), solution), nil
		}
	}
	return false, err
}

func captchaServer(w http.ResponseWriter, req *http.Request) {
	if req.Method == "GET" {
		w.Header().Set("Content-Type", "text/html; charset=utf-8")
		fmt.Fprintf(w, "%s", captcha.New())
		return
	} else if req.Method == "POST" {
		if captcha.VerifyString(req.FormValue("captchaId"), req.FormValue("captchaSolution")) {
		} else {
		}
	}
}

/*
	Checks to make sure the user gave a valid CAPTCHA solution.
	(Note: if false is returned, this function takes care of serving a webpage to the user)
	Parameters:
		ctx:	the context of the http request
		id:		the id string for the captcha we are to check the solution against
		soln:	the solution the user submitted to the CAPTCHA
	Returns:
		bool:	true if the user entered a correct solution, false otherwise.
		string:	A string containing the error text as to why the solution was not accepted, or nil
		error:	Any error that was encountered
*/
func goodCaptchaSolution(ctx *web.Context, id, soln string) (bool, string, error) {
	//make sure we were given a non-empty ID
	if id == "" {
		return false, "INTERNAL ERROR", errors.New("Attempting to verify CAPTCHA with empty ID")
	} else if soln == "" { //Make sure they actually answered the CAPTCHA
		return false, "You must enter a solution to the CAPTCHA to generate a short link", nil
	} else if !captcha.VerifyString(ctx.Params["captcha_id"], soln) { //They didn't give a correct solution
		return false, "The solution to the CAPTCHA that you entered was incorrect", nil
	}
	//The user gave us a correct solution to the CAPTCHA
	return true, "", nil
}

// IsCaptchaValid checks (when the app is not in the developing mode) if the
// captcha is correct for a particular name
func (Adapter *Adapter) IsCaptchaValid(page string) bool {
	value := strings.TrimSpace(Adapter.GetString(page + "-captcha-value"))
	id := strings.TrimSpace(Adapter.GetString(page + "-captcha-id"))
	if !Adapter.IsProductionMode() {
		return true
	}

	if !Adapter.IsCaptchaRequired(page) {
		return true
	}
	return captcha.VerifyString(id, value)

}

// 用户注册表单提交
func (this *UserController) RegisterAction() {
	flash := beego.NewFlash()
	user := &models.User{}
	err := this.ParseForm(user)
	if err != nil {
		beego.Error("用户注册失败:" + err.Error())
		flash.Error("注册用户失败!")
		flash.Store(&this.Controller)
		this.Redirect("/register", 302) //注册失败,重定向到注册页
		return
	}

	user.Password = models.MD5(user.Password) //将密码以MD5加密存储
	user.Registed = time.Now().Local()        //用户注册时间
	user.Lastlogin = time.Now().Local()       //用户最后登录时间
	user.Registeip = this.Ctx.Input.IP()      //用户注册的ip

	captchaCode := this.Input().Get("captcha")

	//判断验证码是否正确
	if !captcha.VerifyString(this.GetSession("captchaStr").(string), captchaCode) {
		flash.Error("验证码不正确!")
		flash.Store(&this.Controller)
		this.DelSession("captchaStr")   //从session中清空
		this.Redirect("/register", 302) //验证码不正确,重定向到登录页
		return
	} else {
		if models.CheckUser(user.Username) { //判断该用户是否已经存在
			flash.Error("该用户已存在!")
			flash.Store(&this.Controller)
			this.Redirect("/register", 302) //该用户已存在,重定向到注册页
			return
		} else {
			err = models.RegisterUser(user) //用户注册
			if err != nil {
				flash.Error("注册用户失败!")
				flash.Store(&this.Controller)
				this.Redirect("/register", 302) //验证码不正确,重定向到注册页
				return
			}
		}

	}
	flash.Notice("注册成功!")
	flash.Store(&this.Controller)
	this.Redirect("/login", 302) //注册成功,重定向到登录页
	return
}

func verifyCaptcha(writer http.ResponseWriter, request *http.Request) {
	captchaId := request.URL.Query().Get("captchaId")
	verifyString := request.URL.Query().Get("verifyString")

	clientId := validationStore.Get(captchaId, true)

	result := captcha.VerifyString(captchaId, verifyString)
	if result {
		privateKey := userStore.Get(clientId, false)
		md5String := fmt.Sprintf("%x", md5.Sum([]byte(privateKey+captchaId)))
		validationStore.Set(md5String, clientId)
		io.WriteString(writer, md5String)
	} else {
		io.WriteString(writer, "fail")
	}
}

func login(w http.ResponseWriter, r *http.Request, s sessions.Session, logger *log.Logger) {
	r.ParseForm()
	username := r.PostForm.Get("username")
	password := r.PostForm.Get("password")
	checkcode := r.PostForm.Get("checkcode")

	code := s.Get("checkcode")
	if !captcha.VerifyString(code.(string), checkcode) {
		w.Write(jsonResponse(map[string]interface{}{"status": false, "msg": "验证码错误"}))
	} else {
		user := &data.User{Logger: logger}
		if user.Check(username, password) {
			s.Set("useradmin", username)
			w.Write(jsonResponse(map[string]interface{}{"status": true, "msg": "success"}))
		} else {
			w.Write(jsonResponse(map[string]interface{}{"status": false, "msg": "用户名或密码错误"}))
		}
	}
}

func (self *CaptchaContext) Challenge(w http.ResponseWriter, r *http.Request, edge string) *ProxyError {
	captchaId := r.PostFormValue("captchaId")
	solution := r.PostFormValue("captchaSolution")

	// Verify the input.
	if captcha.VerifyString(captchaId, solution) {
		token, err := self.GenerateToken()
		if err != nil {
			return &ProxyError{
				Code: 500,
				Msg:  "Unable to generate token value.",
				Err:  err,
			}
		}
		// Strip the port off, since I cannot use them in the cookie.
		parts := strings.Split(edge, ":")
		http.SetCookie(w, &http.Cookie{
			Name:    HumanCookieName,
			Value:   token,
			Expires: time.Now().Add(self.ValidDuration),
			Domain:  "." + parts[0],
			Path:    "/",
		})
		http.Redirect(w, r, r.URL.Path, 302)
		return nil
	}

	// Deal with displaying the Captcha.
	if strings.HasPrefix(r.URL.Path, "/captcha/") {
		self.Generator.ServeHTTP(w, r)
		return nil
	} else {
		if err := captchaTemplate.Execute(w, &struct{ CaptchaId string }{captcha.New()}); err != nil {
			return &ProxyError{
				Code: 500,
				Msg:  "Unable to generate captcha page.",
				Err:  err,
			}
		}
		return nil
	}
}

// addComment responds to a POST request for adding a comment to a post
// with an ident matching "postname". If such a post cannot be found,
// a 404 page is shown.
// Form data is trimmed and the CAPTCHA is verified before anything else.
// Finally, we add the comment but make sure to wrap it in an addCommentLocker.
// This makes it so only a single comment can be added at a time for one
// particular entry. This allows us to rely on the existing cache to provide
// a unique identifier as a comment file name. (i.e., an incrementing integer.)
func addComment(w http.ResponseWriter, req *http.Request) {
	// render404(w, "add comment")
	// return

	vars := mux.Vars(req)
	post := forceValidPost(w, vars["postname"])
	if post == nil {
		return
	}

	// Get the form values.
	author := strings.TrimSpace(req.FormValue("plato"))
	email := strings.TrimSpace(req.FormValue("email"))
	comment := strings.TrimSpace(req.FormValue("cauchy"))

	// First check the captcha before anything else.
	captchaId := req.FormValue("captchaid")
	userTest := req.FormValue("captcha")
	if !captcha.VerifyString(captchaId, userTest) {
		renderPost(w, post,
			"The CAPTCHA text you entered did not match the text in the "+
				"image. Please try again.", author, email, comment)
		return
	}

	// We need to make sure only one comment per post can be added at a time.
	// Namely, we need unique sequential identifiers for each comment.
	post.addCommentLocker.Lock()
	defer post.addCommentLocker.Unlock()

	// Add the comment and refresh the comment store for this post.
	// 'addComment' makes sure the input is valid and reports an
	// error otherwise.
	err := post.addComment(author, email, comment)
	if err == nil { // success!
		post.loadComments()
		http.Redirect(w, req, "/"+post.Ident+"#comments", http.StatusFound)
	} else { // failure... :-(
		renderPost(w, post, err.Error(), author, email, comment)
	}
}

// VerifyCAPTCHA accepts a *http.Request and verifies that the given
// 'captcha' form is valid. This is a string of the form
// "id:solution". It will return IncorrectCAPTCHAError if the solution
// or ID is invalid.
func VerifyCAPTCHA(req *http.Request) error {
	// Get the "captcha" form value.
	solution := req.FormValue("captcha")

	// Find the point to split the form value at. If it's not found in
	// the string, return the InvalidCAPTCHAFormat error.
	index := strings.Index(solution, ":")
	if index < 0 {
		return InvalidCAPTCHAFormat
	}

	// If that was successful, try to verify it. If it returns false,
	// the ID or solution was invalid.
	if !captcha.VerifyString(solution[:index], solution[index+1:]) {
		return IncorrectCAPTCHA
	}

	// If we get to this point, then it was successfully validated and
	// we can return nil.
	return nil
}

// 用户注册
// uri: /account/register{json:(|.json)}
func RegisterHandler(rw http.ResponseWriter, req *http.Request) {
	if _, ok := filter.CurrentUser(req); ok {
		util.Redirect(rw, req, "/")
		return
	}

	vars := mux.Vars(req)
	username := req.PostFormValue("username")
	// 请求注册页面
	if username == "" || req.Method != "POST" || vars["json"] == "" {
		filter.SetData(req, map[string]interface{}{"captchaId": captcha.NewLen(4)})
		req.Form.Set(filter.CONTENT_TPL_KEY, "/template/register.html")
		return
	}

	// 校验验证码
	if !captcha.VerifyString(req.PostFormValue("captchaid"), req.PostFormValue("captchaSolution")) {
		fmt.Fprint(rw, `{"ok": 0, "error":"验证码错误"}`)
		return
	}

	// 入库
	errMsg, err := service.CreateUser(req.PostForm)
	if err != nil {
		// bugfix：http://studygolang.com/topics/255
		if errMsg == "" {
			errMsg = err.Error()
		}
		fmt.Fprint(rw, `{"ok": 0, "error":"`, errMsg, `"}`)
		return
	}

	// 注册成功，自动为其登录
	setCookie(rw, req, req.PostFormValue("username"))
	// 发送欢迎邮件
	go sendWelcomeMail([]string{req.PostFormValue("email")})
	fmt.Fprint(rw, `{"ok": 1, "msg":"注册成功"}`)
}

// verify a captcha
func (cs *CaptchaServer) VerifyCaptcha(w http.ResponseWriter, r *http.Request) {
	dec := json.NewDecoder(r.Body)
	defer r.Body.Close()
	// request
	req := make(map[string]string)
	// response
	resp := make(map[string]interface{})
	resp["solved"] = false
	// decode request
	err := dec.Decode(req)
	if err == nil {
		// decode okay
		id, ok := req["id"]
		if ok {
			// we have id
			solution, ok := req["solution"]
			if ok {
				// we have solution and id
				resp["solved"] = captcha.VerifyString(id, solution)
			} else {
				// we don't have solution
				err = errors.New("no captcha solution provided")
			}
		} else {
			// we don't have id
			err = errors.New("no captcha id provided")
		}
	}
	if err != nil {
		// error happened
		resp["error"] = err.Error()
	}
	// send reply
	w.Header().Set("Content-Type", "text/json; encoding=UTF-8")
	enc := json.NewEncoder(w)
	enc.Encode(resp)
}

//登陆
func (c *User) Login(admin *models.Admin) revel.Result {

	if c.Request.Method == "GET" {
		title := "登陆--GoCMS管理系统"

		CaptchaId := captcha.NewLen(6)

		return c.Render(title, CaptchaId)
	} else {
		var username string = c.Params.Get("username")
		var password string = c.Params.Get("password")

		var captchaId string = c.Params.Get("captchaId")
		var verify string = c.Params.Get("verify")

		data := make(map[string]string)

		if LANG, ok := c.Session["Lang"]; ok {
			//设置语言
			c.Request.Locale = LANG
		} else {
			//设置默认语言
			c.Request.Locale = "zh"
		}

		if !captcha.VerifyString(captchaId, verify) {
			data["status"] = "0"
			data["url"] = "/"
			data["message"] = c.Message("verification_code")
			return c.RenderJson(data)
		}

		if len(username) <= 0 {
			data["status"] = "0"
			data["url"] = "/"
			data["message"] = c.Message("login_user_name")
			return c.RenderJson(data)
		}

		if len(password) <= 0 {
			data["status"] = "0"
			data["url"] = "/"
			data["message"] = c.Message("login_password")
			return c.RenderJson(data)
		}

		if len(verify) <= 0 {
			data["status"] = "0"
			data["url"] = "/"
			data["message"] = c.Message("login_verification_code")
			return c.RenderJson(data)
		}

		admin_info := admin.GetByName(username)

		if admin_info.Id <= 0 {
			data["status"] = "0"
			data["url"] = "/"
			data["message"] = c.Message("admin_username_error")
		} else if admin_info.Status == 0 && admin_info.Id != 1 {
			data["status"] = "0"
			data["url"] = "/"
			data["message"] = c.Message("admin_forbid_login")
		} else if admin_info.Role.Status == 0 && admin_info.Id != 1 {
			data["status"] = "0"
			data["url"] = "/"
			data["message"] = c.Message("admin_forbid_role_login")
		} else if username == admin_info.Username && utils.Md5(password) == admin_info.Password {

			/*
			* %% 印出百分比符号，不转换。
			* %c 整数转成对应的 ASCII 字元。
			* %d 整数转成十进位。
			* %f 倍精确度数字转成浮点数。
			* %o 整数转成八进位。
			* %s 整数转成字符串。
			* %x 整数转成小写十六进位。
			* %X 整数转成大写十六进位
			 */
			c.Session["UserID"] = fmt.Sprintf("%d", admin_info.Id)
			c.Session["Lang"] = admin_info.Lang

			c.Flash.Success(c.Message("login_success"))
			c.Flash.Out["url"] = "/"

			//更新登陆时间
			if ip := c.Request.Header.Get("X-Forwarded-For"); ip != "" {
				ips := strings.Split(ip, ",")
				if len(ips) > 0 && ips[0] != "" {
					rip := strings.Split(ips[0], ":")
					admin.Lastloginip = rip[0]
				}
			} else {
				ip := strings.Split(c.Request.RemoteAddr, ":")
				if len(ip) > 0 {
					if ip[0] != "[" {
						admin.Lastloginip = ip[0]
					}
				}
//.........这里部分代码省略.........

func CheckCaptcha(r *http.Request) bool {
	return captcha.VerifyString(r.FormValue("captchaId"), r.FormValue("captchaSolution"))
}

/* 注册 */
func (this *CheckController) Register() {
	ok, data := func() (bool, interface{}) {
		if len([]rune(this.GetString("email"))) > 100 {
			return false, "邮箱过长"
		}

		if strings.Contains(this.GetString("email"), "|") {
			return false, "邮箱不能含有“|”符号"
		}

		if len([]rune(this.GetString("nickname"))) < 3 || len([]rune(this.GetString("nickname"))) > 20 {
			return false, "昵称长度为3-20"
		}

		if strings.Contains(this.GetString("nickname"), "|") {
			return false, "昵称不能含有“|”符号"
		}

		if len([]rune(this.GetString("password"))) < 6 || len([]rune(this.GetString("password"))) > 30 {
			return false, "密码长度为6-30"
		}

		if strings.Contains(this.GetString("password"), "|") {
			return false, "密码不能含有“|”符号"
		}

		if this.GetSession("WOKUID") != nil { //已有session则退出
			return false, "已登录"
		}

		//验证码校验
		cap_id, cap_value := this.GetString("capid"), this.GetString("cap")
		if ok := captcha.VerifyString(cap_id, cap_value); !ok {
			return false, "验证码错误"
		}

		//数据赋值
		user := &UserController{}
		user.member.Email = this.GetString("email")
		user.member.Nickname = this.GetString("nickname")
		user.member.Password = this.GetString("password")
		user.member.Type = 1 //普通会员

		//检测邮箱是否已存在
		if objectid := user.member.EmailExist(this.GetString("email")); objectid != "" {
			return false, "您的账号已存在，可以直接登录"
		}

		//检测昵称是否存在
		if objectid := user.member.NicknameExist(this.GetString("nickname")); objectid != "" {
			return false, "昵称已被使用"
		}

		//生成参数
		_, urlParams := user.member.CreateSign(time.Now().Unix()+3600, "createAccount", this.GetString("email")+"|"+this.GetString("nickname")+"|"+this.GetString("password"))

		//发送验证邮件
		SendEmail([]string{user.member.Email}, user.member.Nickname+"：您的我酷账号申请成功，请点击链接激活！"+time.Now().String(), `
		您好：`+user.member.Nickname+`<br><br>
		（请在一小时内完成）您需要点击以下链接来激活您的我酷账户：<br><br>
		http://`+beego.AppConfig.String("httpWebSite")+`/auth`+urlParams)

		return true, nil
	}()

	this.Data["json"] = map[string]interface{}{
		"ok":   ok,
		"data": data,
	}
	this.ServeJson()
}

//登陆
func (c *User) Login(admin *models.Admin) revel.Result {

	if c.Request.Method == "GET" {
		title := "登陆--GoCMS管理系统"

		CaptchaId := captcha.NewLen(6)

		return c.Render(title, CaptchaId)
	} else {
		var username string = c.Params.Get("username")
		var password string = c.Params.Get("password")

		var captchaId string = c.Params.Get("captchaId")
		var verify string = c.Params.Get("verify")

		data := make(map[string]string)

		if !captcha.VerifyString(captchaId, verify) {
			data["status"] = "0"
			data["url"] = "/"
			data["message"] = "验证码错误!"
			return c.RenderJson(data)
		}

		if len(username) <= 0 {
			data["status"] = "0"
			data["url"] = "/"
			data["message"] = "请填写用户名!"
			return c.RenderJson(data)
		}

		if len(password) <= 0 {
			data["status"] = "0"
			data["url"] = "/"
			data["message"] = "请填写密码!"
			return c.RenderJson(data)
		}

		if len(verify) <= 0 {
			data["status"] = "0"
			data["url"] = "/"
			data["message"] = "请填写验证码!"
			return c.RenderJson(data)
		}

		admin_info := admin.GetByName(username)

		if admin_info.Id <= 0 {
			data["status"] = "0"
			data["url"] = "/"
			data["message"] = "用户名错误!"
		} else if admin_info.Status == 0 && admin_info.Id != 1 {
			data["status"] = "0"
			data["url"] = "/"
			data["message"] = "此账号禁止登陆!"
		} else if admin_info.Role.Status == 0 && admin_info.Id != 1 {
			data["status"] = "0"
			data["url"] = "/"
			data["message"] = "所属角色禁止登陆!"
		} else if username == admin_info.Username && utils.Md5(password) == admin_info.Password {
			c.Session["UserID"] = fmt.Sprintf("%d", admin_info.Id)

			c.Flash.Success("登陆成功！欢迎您 " + admin_info.Realname)
			c.Flash.Out["url"] = "/"

			//更新登陆时间
			admin.UpdateLoginTime(admin_info.Id)

			//******************************************
			//管理员日志
			logs := new(models.Logs)
			desc := "登陆用户名:" + admin_info.Username + "|^|登陆系统!|^|登陆ID:" + fmt.Sprintf("%d", admin_info.Id)
			logs.Save(admin_info, c.Controller, desc)
			//*****************************************

			data["status"] = "1"
			data["url"] = "/Message/"
			data["message"] = "登陆成功!"
		} else {
			data["status"] = "0"
			data["url"] = "/"
			data["message"] = "密码错误!"
		}

		return c.RenderJson(data)
	}
}