普通用户登录后还是可以进行用户管理

<%@ page contentType="text/html;charset=UTF-8" language="java"%>
<%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c"%>
<%
String basePath=request.getScheme()+"://"+request.getServerName()+":"+request.getServerPort()+request.getContextPath()+"/";
%>
<!DOCTYPE html>
<html>
<head>
<base href="<%=basePath%>">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>登录页面</title>
<style type="text/css">
.c1{
width:300px;
cursor:pointer;
}
.c2{
width:300px;
padding-left: 30px;
}
</style>
</head>
<body>
<c:choose>
<c:when test="${flag=='1'}">
<div class="c1">
<h3 onclick="show1()">用户管理</h3>
<div class="c2" id="menu1" style="display:none;">
<p><a href="<%=basePath%>jsp/addUser.jsp" target="main">添加管理员</a></p>
<p><a href="<%=basePath%>selectUsersServlet" target="main">查询管理员</a></p>
</div>
</div>
</c:when>
<c:otherwise>
<h3>用户管理</h3>
</c:otherwise>
</c:choose>
<div class="c1">
<h3 onclick="show2()">课程管理</h3>
<div class="c2" id="menu2" style="display:none;">
<p><a href="<%=basePath%>jsp/addCourse.jsp" target="main">课程添加</a></p>
<p><a href="<%=basePath%>jsp/courseImport.jsp" target="main">课程批量导入(Excel)</a></p>
<p><a href="<%=basePath%>ExportCourseServlet" target="main">课程导出</a></p>
<p><a href="<%=basePath%>GetCourseServlet" target="main">课程查询</a></p>
</div>
</div>

<script type="text/javascript">
function show1(){
var menu = document.getElementById("menu1");
var displayStyle = menu.style.display;
if(displayStyle=="none"){
menu.style.display="block";
}else{
menu.style.display="none";
}

}
function show2(){
var menu = document.getElementById("menu2");
var displayStyle = menu.style.display;
if(displayStyle=="none"){
menu.style.display="block";
}else{
menu.style.display="none";
}
}
</script>
</body>
</html>

package com.vincent.course.servlet;

import com.vincent.course.data.CourseDaoImpl;
import com.vincent.course.data.Users;
import org.omg.PortableInterceptor.SYSTEM_EXCEPTION;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.List;
import java.util.Map;

public class LoginServlet extends HttpServlet {
@Override
protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
doPost(req,resp);
}

@Override
protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
req.setCharacterEncoding("utf-8");
resp.setCharacterEncoding("utf-8");
//后台校验用户名、密码、验证码是否正确
String username=req.getParameter("username");
String password=req.getParameter("password");
System.out.println("用户名:"+username+"\n"+"密码:"+password);
boolean flag1=username.matches("[a-zA-Z_0-9]{3,12}");
boolean flag2=password.matches("[a-zA-Z_0-9]{3,12}");
if(flag1&&flag2){
//获取用户输入的验证码
String code1=req.getParameter("checkCode");
//获取系统产生的验证码
String code2= (String) req.getSession().getAttribute("kcode");
System.out.println(code1+"==="+code2);
if(code1!=null&&code2!=null){
if(code1.equalsIgnoreCase(code2)){
//验证码正确,判断是普通用户还是超级用户
if(username.equals("imooc")){
if(password.equals("imooc")){
//超级用户登录成功
req.getSession().setAttribute("username",username);
req.getSession().setAttribute("flag","1");
resp.sendRedirect(req.getContextPath()+"/jsp/server.jsp");
System.out.println("超级用户登录成功!");
return;
}else{
//密码错误
req.getSession().setAttribute("msg","密码错误");
req.getRequestDispatcher("/jsp/index.jsp").forward(req,resp);
System.out.println("超级用户登录失败");
}
}else{
//普通用户
CourseDaoImpl cdi = new CourseDaoImpl();
int n= cdi.login(username,password);
if(n==0){
//登录成功
req.getSession().setAttribute("username",username);
resp.sendRedirect(req.getContextPath()+"/jsp/server.jsp");
System.out.println("普通用户登录成功");
return;
}else if(n==1){
//用户名或密码错误
req.getSession().setAttribute("msg","用户名或密码错误!");
req.getRequestDispatcher("/jsp/index.jsp").forward(req,resp);
System.out.println("普通用户登录失败!");
}else{
//用户不存在
req.getSession().setAttribute("msg","用户不存在！");
req.getRequestDispatcher("/jsp/index.jsp").forward(req,resp);
System.out.println("用户不存在!");
}
}
}else{
//验证码错误
System.out.println("验证码错误!");
req.getSession().setAttribute("msg","验证码错误！");
req.getRequestDispatcher("/jsp/index.jsp").forward(req,resp);
}
}else {
//验证码为空
System.out.println("验证码为空!");
req.getSession().setAttribute("msg","请输入验证码！");
req.getRequestDispatcher("/jsp/index.jsp").forward(req,resp);
}

}else {
//后端验证失败
System.out.println("后端验证失败");
req.setAttribute("msg","请先登录!");
req.getRequestDispatcher("/jsp/index.jsp").forward(req,resp);
}
}
}