@Override
public void updatePwd(User user, String newPwd) throws ServiceException {
//设定安全的密码,使用passwordService提供的salt并经过1024次 sha-1 hash
boolean isMatch = ShiroDbRealm.validatePassword(user.getPlainPassword(), user.getPassword(), user.getSalt());
if (isMatch) {
HashPassword hashPassword = ShiroDbRealm.encryptPassword(newPwd);
user.setSalt(hashPassword.salt);
user.setPassword(hashPassword.password);
userDAO.save(user);
shiroRealm.clearCachedAuthorizationInfo(user.getUsername());