diff --git a/Roadmap.txt b/Roadmap.txt
index a501c5573..eac97225e 100644
--- a/Roadmap.txt
+++ b/Roadmap.txt
@@ -20,6 +20,8 @@
 	
 待定：
 	
+	修复在已登录状态下打开/login地址会死循环的BUG；
+	修复登录超时后打开页面内对话框未处理超时的BUG；
 	看板图表新增导出数据功能；
 	共享看板支持设置密码；
 	看板模板管理功能和内置看板模板；
diff --git a/datagear-management/src/main/java/org/datagear/management/service/SchemaGuardService.java b/datagear-management/src/main/java/org/datagear/management/service/SchemaGuardService.java
index 445145e7d..67fbcf534 100644
--- a/datagear-management/src/main/java/org/datagear/management/service/SchemaGuardService.java
+++ b/datagear-management/src/main/java/org/datagear/management/service/SchemaGuardService.java
@@ -7,6 +7,7 @@
 
 package org.datagear.management.service;
 
+import org.datagear.management.domain.Schema;
 import org.datagear.management.domain.SchemaGuard;
 
 /**
@@ -17,4 +18,29 @@
  */
 public interface SchemaGuardService extends EntityService<String, SchemaGuard>
 {
+	/**
+	 * 是否允许创建指定的{@linkplain Schema#getUrl()}。
+	 * <p>
+	 * 实现类应支持{@code *}（表示任意多个字符）匹配规则，例如：
+	 * </p>
+	 * <ul>
+	 * <li>{@code *}<br>
+	 * 匹配任意URL</li>
+	 * <li>{@code *abc}<br>
+	 * 匹配以{@code abc}结尾的URL</li>
+	 * <li>{@code abc*}<br>
+	 * 匹配以{@code abc}开头的URL</li>
+	 * <li>{@code abc*def}<br>
+	 * 匹配以{@code abc}开头、以{@code def}结尾的URL</li>
+	 * <li>{@code *abc*def*}<br>
+	 * 匹配依次包含{@code abc}、{@code def}的URL</li>
+	 * </ul>
+	 * <p>
+	 * 另外，如果没有定义任何{@linkplain SchemaGuard}，应返回{@code true}。
+	 * </p>
+	 * 
+	 * @param schemaURL
+	 * @return
+	 */
+	boolean isPermitted(String schemaUrl);
 }
diff --git a/datagear-management/src/main/java/org/datagear/management/service/impl/SchemaGuardServiceImpl.java b/datagear-management/src/main/java/org/datagear/management/service/impl/SchemaGuardServiceImpl.java
index 93ea72b0d..f04303703 100644
--- a/datagear-management/src/main/java/org/datagear/management/service/impl/SchemaGuardServiceImpl.java
+++ b/datagear-management/src/main/java/org/datagear/management/service/impl/SchemaGuardServiceImpl.java
@@ -7,6 +7,8 @@
 
 package org.datagear.management.service.impl;
 
+import java.util.ArrayList;
+import java.util.Collections;
 import java.util.List;
 import java.util.Map;
 
@@ -15,6 +17,9 @@
 import org.datagear.management.domain.SchemaGuard;
 import org.datagear.management.service.SchemaGuardService;
 import org.datagear.management.util.dialect.MbSqlDialect;
+import org.datagear.persistence.Query;
+import org.datagear.util.AsteriskPatternMatcher;
+import org.datagear.util.StringUtil;
 import org.mybatis.spring.SqlSessionTemplate;
 
 /**
@@ -28,6 +33,10 @@ public class SchemaGuardServiceImpl extends AbstractMybatisEntityService<String,
 {
 	protected static final String SQL_NAMESPACE = SchemaGuard.class.getName();
 
+	private AsteriskPatternMatcher asteriskPatternMatcher = new AsteriskPatternMatcher();
+
+	private volatile List<SchemaGuard> _schemaGuardListCache = null;
+
 	public SchemaGuardServiceImpl()
 	{
 		super();
@@ -43,6 +52,77 @@ public SchemaGuardServiceImpl(SqlSessionTemplate sqlSessionTemplate, MbSqlDialec
 		super(sqlSessionTemplate, dialect);
 	}
 
+	public AsteriskPatternMatcher getAsteriskPatternMatcher()
+	{
+		return asteriskPatternMatcher;
+	}
+
+	public void setAsteriskPatternMatcher(AsteriskPatternMatcher asteriskPatternMatcher)
+	{
+		this.asteriskPatternMatcher = asteriskPatternMatcher;
+	}
+
+	@Override
+	public boolean isPermitted(String schemaUrl)
+	{
+		if (this._schemaGuardListCache == null)
+		{
+			List<SchemaGuard> schemaGuards = query("getAll", new Query(), buildParamMap(), true);
+			SchemaGuard.sortByPriority(schemaGuards);
+			this._schemaGuardListCache = Collections.unmodifiableList(new ArrayList<SchemaGuard>(schemaGuards));
+		}
+
+		// 默认为true，表示允许，比如当没有定义任何SchemaGuard时
+		boolean permitted = true;
+
+		for (SchemaGuard schemaGuard : this._schemaGuardListCache)
+		{
+			if (!schemaGuard.isEnabled())
+				continue;
+
+			String pattern = schemaGuard.getPattern();
+			
+			if(StringUtil.isEmpty(pattern))
+				continue;
+			
+			if (this.asteriskPatternMatcher.matches(pattern, schemaUrl))
+			{
+				permitted = schemaGuard.isPermitted();
+				break;
+			}
+		}
+
+		return permitted;
+	}
+
+	@Override
+	protected boolean update(SchemaGuard entity, Map<String, Object> params)
+	{
+		boolean re = super.update(entity, params);
+
+		this._schemaGuardListCache = null;
+
+		return re;
+	}
+
+	@Override
+	protected boolean deleteById(String id, Map<String, Object> params)
+	{
+		boolean re = super.deleteById(id, params);
+
+		this._schemaGuardListCache = null;
+
+		return re;
+	}
+
+	@Override
+	protected void add(SchemaGuard entity, Map<String, Object> params)
+	{
+		super.add(entity, params);
+
+		this._schemaGuardListCache = null;
+	}
+
 	@Override
 	protected List<SchemaGuard> query(String statement, Map<String, Object> params)
 	{
diff --git a/datagear-management/src/main/java/org/datagear/management/service/impl/SchemaServiceImpl.java b/datagear-management/src/main/java/org/datagear/management/service/impl/SchemaServiceImpl.java
index 3d4fea3cb..2d5e219f8 100644
--- a/datagear-management/src/main/java/org/datagear/management/service/impl/SchemaServiceImpl.java
+++ b/datagear-management/src/main/java/org/datagear/management/service/impl/SchemaServiceImpl.java
@@ -15,6 +15,7 @@
 import org.datagear.management.domain.User;
 import org.datagear.management.service.AuthorizationService;
 import org.datagear.management.service.PermissionDeniedException;
+import org.datagear.management.service.SchemaGuardService;
 import org.datagear.management.service.SchemaService;
 import org.datagear.management.service.UserService;
 import org.datagear.management.util.dialect.MbSqlDialect;
@@ -36,6 +37,8 @@ public class SchemaServiceImpl extends AbstractMybatisDataPermissionEntityServic
 
 	private UserService userService;
 
+	private SchemaGuardService schemaGuardService;
+
 	public SchemaServiceImpl()
 	{
 		super();
@@ -43,20 +46,22 @@ public SchemaServiceImpl()
 
 	public SchemaServiceImpl(SqlSessionFactory sqlSessionFactory, MbSqlDialect dialect,
 			AuthorizationService authorizationService,
-			DriverEntityManager driverEntityManager, UserService userService)
+			DriverEntityManager driverEntityManager, UserService userService, SchemaGuardService schemaGuardService)
 	{
 		super(sqlSessionFactory, dialect, authorizationService);
 		this.driverEntityManager = driverEntityManager;
 		this.userService = userService;
+		this.schemaGuardService = schemaGuardService;
 	}
 
 	public SchemaServiceImpl(SqlSessionTemplate sqlSessionTemplate, MbSqlDialect dialect,
 			AuthorizationService authorizationService,
-			DriverEntityManager driverEntityManager, UserService userService)
+			DriverEntityManager driverEntityManager, UserService userService, SchemaGuardService schemaGuardService)
 	{
 		super(sqlSessionTemplate, dialect, authorizationService);
 		this.driverEntityManager = driverEntityManager;
 		this.userService = userService;
+		this.schemaGuardService = schemaGuardService;
 	}
 
 	public DriverEntityManager getDriverEntityManager()
@@ -79,6 +84,16 @@ public void setUserService(UserService userService)
 		this.userService = userService;
 	}
 
+	public SchemaGuardService getSchemaGuardService()
+	{
+		return schemaGuardService;
+	}
+
+	public void setSchemaGuardService(SchemaGuardService schemaGuardService)
+	{
+		this.schemaGuardService = schemaGuardService;
+	}
+
 	@Override
 	public String getResourceType()
 	{
@@ -157,8 +172,13 @@ protected void checkInput(Schema entity)
 	 */
 	protected void checkSaveUrlPermission(User user, String url) throws SaveSchemaUrlPermissionDeniedException
 	{
-		// TODO 新增数据源防护功能，管理员可设置URL白/黑名单，只允许新建名单允许的数据源
-		// throw new SaveSchemaUrlPermissionDeniedException();
+		if (user.isAdmin())
+			return;
+
+		if (this.schemaGuardService.isPermitted(url))
+			return;
+
+		throw new SaveSchemaUrlPermissionDeniedException();
 	}
 
 	@Override
diff --git a/datagear-management/src/main/resources/org/datagear/management/mapper/SchemaGuardMapper.xml b/datagear-management/src/main/resources/org/datagear/management/mapper/SchemaGuardMapper.xml
index e9008dc39..743564b40 100644
--- a/datagear-management/src/main/resources/org/datagear/management/mapper/SchemaGuardMapper.xml
+++ b/datagear-management/src/main/resources/org/datagear/management/mapper/SchemaGuardMapper.xml
@@ -41,6 +41,13 @@
 			T.${_iq_}id${_iq_} = #{id}
 	</select>
 	
+	<select id="getAll" resultType="org.datagear.management.domain.SchemaGuard">
+		SELECT
+			T.*
+		FROM
+			(<include refid="queryView" />) T
+	</select>
+	
 	<select id="query" resultType="org.datagear.management.domain.SchemaGuard">
 		SELECT
 			T.*
diff --git a/datagear-util/src/main/java/org/datagear/util/AsteriskPatternMatcher.java b/datagear-util/src/main/java/org/datagear/util/AsteriskPatternMatcher.java
new file mode 100644
index 000000000..3088e067b
--- /dev/null
+++ b/datagear-util/src/main/java/org/datagear/util/AsteriskPatternMatcher.java
@@ -0,0 +1,190 @@
+/*
+ * Copyright 2018 datagear.tech
+ *
+ * Licensed under the LGPLv3 license:
+ * http://www.gnu.org/licenses/lgpl-3.0.html
+ */
+
+package org.datagear.util;
+
+import java.io.Serializable;
+import java.util.Iterator;
+import java.util.concurrent.CopyOnWriteArrayList;
+import java.util.regex.Pattern;
+
+/**
+ * 基于星号模式（{@code *}，表示任意个任意字符）的匹配器。
+ * <p>
+ * 匹配规则如下：
+ * </p>
+ * <ul>
+ * <li>{@code *}<br>
+ * 匹配任意字符串</li>
+ * <li>{@code *abc}<br>
+ * 匹配以{@code abc}结尾的字符串</li>
+ * <li>{@code abc*}<br>
+ * 匹配以{@code abc}开头的字符串</li>
+ * <li>{@code abc*def}<br>
+ * 匹配以{@code abc}开头、以{@code def}结尾的字符串</li>
+ * <li>{@code *abc*def*}<br>
+ * 匹配依次包含{@code abc}、{@code def}的字符串</li>
+ * </ul>
+ * 
+ * @author datagear@163.com
+ *
+ */
+public class AsteriskPatternMatcher
+{
+	private CopyOnWriteArrayList<AsteriskRegexPattern> asteriskRegexPatternCache = new CopyOnWriteArrayList<AsteriskRegexPattern>();
+
+	private int cacheSize = 100;
+
+	public AsteriskPatternMatcher()
+	{
+		super();
+	}
+
+	protected int getCacheSize()
+	{
+		return cacheSize;
+	}
+
+	protected void setCacheSize(int cacheSize)
+	{
+		this.cacheSize = cacheSize;
+	}
+
+	/**
+	 * 是否匹配。
+	 * 
+	 * @param asteriskPattern
+	 *            星号模式字符串
+	 * @param text
+	 *            要匹配的字符串
+	 * @return
+	 */
+	public boolean matches(String asteriskPattern, String text)
+	{
+		Pattern rp = getRegexPattern(asteriskPattern);
+		return rp.matcher(text).matches();
+	}
+
+	protected Pattern getRegexPattern(String asteriskPattern)
+	{
+		Iterator<AsteriskRegexPattern> it = this.asteriskRegexPatternCache.iterator();
+		while (it.hasNext())
+		{
+			AsteriskRegexPattern arp = it.next();
+
+			if (arp.getAsteriskPattern().equals(asteriskPattern))
+				return arp.getRegexPattern();
+		}
+
+		Pattern rp = buildRegexPattern(asteriskPattern);
+
+		AsteriskRegexPattern arp = new AsteriskRegexPattern(asteriskPattern, rp);
+		this.asteriskRegexPatternCache.add(arp);
+
+		while (this.asteriskRegexPatternCache.size() > this.cacheSize)
+			this.asteriskRegexPatternCache.remove(0);
+
+		return rp;
+	}
+
+	/**
+	 * 将星号模式字符串转换为正则字符串。
+	 * 
+	 * @param asteriskPattern
+	 * @return
+	 */
+	protected Pattern buildRegexPattern(String asteriskPattern)
+	{
+		StringBuilder pb = new StringBuilder();
+
+		pb.append('^');
+
+		char[] cs = asteriskPattern.toCharArray();
+		StringBuilder lb = new StringBuilder();
+		for (int i = 0; i < cs.length; i++)
+		{
+			char c = cs[i];
+
+			if (c == '*')
+			{
+				if (lb.length() > 0)
+				{
+					pb.append(Pattern.quote(lb.toString()));
+					lb.delete(0, lb.length());
+				}
+
+				pb.append(".*");
+			}
+			else
+				lb.append(c);
+		}
+
+		if (lb.length() > 0)
+			pb.append(Pattern.quote(lb.toString()));
+
+		pb.append('$');
+
+		String regex = pb.toString();
+
+		return Pattern.compile(regex);
+	}
+
+	private static class AsteriskRegexPattern implements Serializable
+	{
+		private static final long serialVersionUID = 1L;
+
+		private final String asteriskPattern;
+
+		private final Pattern regexPattern;
+
+		public AsteriskRegexPattern(String asteriskPattern, Pattern regexPattern)
+		{
+			super();
+			this.asteriskPattern = asteriskPattern;
+			this.regexPattern = regexPattern;
+		}
+
+		public String getAsteriskPattern()
+		{
+			return asteriskPattern;
+		}
+
+		public Pattern getRegexPattern()
+		{
+			return regexPattern;
+		}
+
+		@Override
+		public int hashCode()
+		{
+			final int prime = 31;
+			int result = 1;
+			result = prime * result + ((asteriskPattern == null) ? 0 : asteriskPattern.hashCode());
+			return result;
+		}
+
+		@Override
+		public boolean equals(Object obj)
+		{
+			if (this == obj)
+				return true;
+			if (obj == null)
+				return false;
+			if (getClass() != obj.getClass())
+				return false;
+			AsteriskRegexPattern other = (AsteriskRegexPattern) obj;
+			if (asteriskPattern == null)
+			{
+				if (other.asteriskPattern != null)
+					return false;
+			}
+			else if (!asteriskPattern.equals(other.asteriskPattern))
+				return false;
+			return true;
+		}
+	}
+}
diff --git a/datagear-util/src/test/java/org/datagear/util/AsteriskPatternMatcherTest.java b/datagear-util/src/test/java/org/datagear/util/AsteriskPatternMatcherTest.java
new file mode 100644
index 000000000..fa1497ea8
--- /dev/null
+++ b/datagear-util/src/test/java/org/datagear/util/AsteriskPatternMatcherTest.java
@@ -0,0 +1,99 @@
+/*
+ * Copyright 2018 datagear.tech
+ *
+ * Licensed under the LGPLv3 license:
+ * http://www.gnu.org/licenses/lgpl-3.0.html
+ */
+
+package org.datagear.util;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+import org.junit.Test;
+
+/**
+ * {@linkplain AsteriskPatternMatcher}单元测试类。
+ * 
+ * @author datagear@163.com
+ *
+ */
+public class AsteriskPatternMatcherTest
+{
+	@Test
+	public void test()
+	{
+		AsteriskPatternMatcher matcher = new AsteriskPatternMatcher();
+
+		{
+			String pattern = "*";
+
+			assertTrue(matcher.matches(pattern, ""));
+			assertTrue(matcher.matches(pattern, "abc"));
+		}
+
+		{
+			String pattern = "abc*";
+
+			assertTrue(matcher.matches(pattern, "abc"));
+			assertTrue(matcher.matches(pattern, "abcdef"));
+			assertFalse(matcher.matches(pattern, ""));
+			assertFalse(matcher.matches(pattern, "defabcghi"));
+			assertFalse(matcher.matches(pattern, "def"));
+		}
+
+		{
+			String pattern = "*abc";
+
+			assertTrue(matcher.matches(pattern, "abc"));
+			assertTrue(matcher.matches(pattern, "defabc"));
+			assertFalse(matcher.matches(pattern, ""));
+			assertFalse(matcher.matches(pattern, "abcdef"));
+			assertFalse(matcher.matches(pattern, "def"));
+		}
+
+		{
+			String pattern = "*abc*";
+
+			assertTrue(matcher.matches(pattern, "abc"));
+			assertTrue(matcher.matches(pattern, "abcdef"));
+			assertTrue(matcher.matches(pattern, "defabc"));
+			assertTrue(matcher.matches(pattern, "defabcghi"));
+			assertFalse(matcher.matches(pattern, ""));
+			assertFalse(matcher.matches(pattern, "def"));
+		}
+
+		{
+			String pattern = "abc*ghi";
+
+			assertTrue(matcher.matches(pattern, "abcghi"));
+			assertTrue(matcher.matches(pattern, "abcdefghi"));
+			assertFalse(matcher.matches(pattern, ""));
+			assertFalse(matcher.matches(pattern, "def"));
+			assertFalse(matcher.matches(pattern, "abcdefghijkl"));
+			assertFalse(matcher.matches(pattern, "jklabcdefghi"));
+			assertFalse(matcher.matches(pattern, "jklabcdefghijkl"));
+		}
+
+		{
+			String pattern = "192.168.1.1*";
+
+			assertTrue(matcher.matches(pattern, "192.168.1.1:3306/dg_test"));
+			assertFalse(matcher.matches(pattern, "jdbc:mysql://192.168.1.1:3306/dg_test"));
+		}
+
+		{
+			String pattern = "*192.168.1.1";
+
+			assertTrue(matcher.matches(pattern, "jdbc:mysql://192.168.1.1"));
+			assertFalse(matcher.matches(pattern, "jdbc:mysql://192.168.1.1:3306/dg_test"));
+		}
+
+		{
+			String pattern = "*192.168.1.1*";
+
+			assertTrue(matcher.matches(pattern, "jdbc:mysql://192.168.1.1:3306/dg_test"));
+			assertFalse(matcher.matches(pattern, "jdbc:mysql://192.168.1.2:3306/dg_test"));
+		}
+	}
+}
diff --git a/datagear-web/src/main/java/org/datagear/web/config/CoreConfig.java b/datagear-web/src/main/java/org/datagear/web/config/CoreConfig.java
index 47a892c11..075c10eeb 100644
--- a/datagear-web/src/main/java/org/datagear/web/config/CoreConfig.java
+++ b/datagear-web/src/main/java/org/datagear/web/config/CoreConfig.java
@@ -493,7 +493,7 @@ public AuthorizationService authorizationService()
 	public SchemaService schemaService()
 	{
 		SchemaServiceImpl bean = new SchemaServiceImpl(this.sqlSessionFactory(), this.mbSqlDialect(),
-				this.authorizationService(), this.driverEntityManager(), this.userService());
+				this.authorizationService(), this.driverEntityManager(), this.userService(), this.schemaGuardService());
 
 		return bean;
 	}
diff --git a/datagear-web/src/main/resources/org/datagear/web/i18n/message.properties b/datagear-web/src/main/resources/org/datagear/web/i18n/message.properties
index 7117a4013..bcd1091cb 100644
--- a/datagear-web/src/main/resources/org/datagear/web/i18n/message.properties
+++ b/datagear-web/src/main/resources/org/datagear/web/i18n/message.properties
@@ -941,7 +941,7 @@ schemaGuard.viewSchemaGuard=查看数据源防护
 schemaGuard.selectSchemaGuard=选择数据源防护
 schemaGuard.auth.resouceTypeLabel=数据源防护
 schemaGuard.pattern=URL模式
-schemaGuard.pattern.desc=数据源URL匹配模式，例如：* 所有URL；*192.168.1.1* 所有192.168.1.1的URL；192.168.1.1* 所有192.168.1.1开头的URL
+schemaGuard.pattern.desc=数据源URL匹配模式，例如：* 表示所有URL；*192.168.1.1* 表示所有包含192.168.1.1的URL；jdbc:mysql://127.0.0.1* 表示所有以jdbc:mysql://127.0.0.1开头的URL
 schemaGuard.permitted=准许
 schemaGuard.permitted.desc=是否准许创建匹配上述URL模式的数据源
 schemaGuard.priority=优先级