MHSanaei/3x-ui · warning

The new username and password are empty

Error message

The new username and password are empty

What it means

updateUser requires BOTH newUsername and newPassword to be non-empty after the old-credential check passes; leaving either blank returns this i18n message (pages.settings.toasts.userPassMustBeNotEmpty). The API does not support changing only one of the two fields through this endpoint — even if you only want a new password, you must resend the current username as the new username.

Source

Thrown at internal/web/controller/setting.go:184

	}
	jsonMsg(c, I18nWeb(c, "pages.settings.toasts.modifySettings"), err)
}

// updateUser updates the current user's username and password.
func (a *SettingController) updateUser(c *gin.Context) {
	form := &updateUserForm{}
	err := c.ShouldBind(form)
	if err != nil {
		jsonMsg(c, I18nWeb(c, "pages.settings.toasts.modifySettings"), err)
		return
	}
	user := session.GetLoginUser(c)
	if user.Username != form.OldUsername || !crypto.CheckPasswordHash(user.Password, form.OldPassword) {
		jsonMsg(c, I18nWeb(c, "pages.settings.toasts.modifyUserError"), errors.New(I18nWeb(c, "pages.settings.toasts.originalUserPassIncorrect")))
		return
	}
	if form.NewUsername == "" || form.NewPassword == "" {
		jsonMsg(c, I18nWeb(c, "pages.settings.toasts.modifyUserError"), errors.New(I18nWeb(c, "pages.settings.toasts.userPassMustBeNotEmpty")))
		return
	}
	if err := a.settingService.VerifyTwoFactorCode(form.TwoFactorCode); err != nil {
		jsonMsg(c, I18nWeb(c, "pages.settings.toasts.modifyUserError"), err)
		return
	}
	err = a.userService.UpdateUser(user.Id, form.NewUsername, form.NewPassword)
	if err == nil {
		user.Username = form.NewUsername
		user.Password, _ = crypto.HashPasswordAsBcrypt(form.NewPassword)
		if saveErr := session.SetLoginUser(c, user); saveErr != nil {
			err = saveErr
		}
	}
	jsonMsg(c, I18nWeb(c, "pages.settings.toasts.modifyUser"), err)
}

// restartPanel restarts the panel service after a delay.

View on GitHub (pinned to ad32144c42)

Solutions

1. Send both fields: to keep the username, set newUsername to the existing username
2. If you need one-field-only updates, extend updateUserForm handling server-side rather than sending blanks
3. Validate non-empty in the client before submitting

Example fix

// before
{ oldUsername, oldPassword, newPassword: 'newpass' }

// after
{ oldUsername, oldPassword, newUsername: 'admin', newPassword: 'newpass' }

if strings.TrimSpace(form.NewUsername) == "" || strings.TrimSpace(form.NewPassword) == "" {
    return errors.New("both new username and new password are required")
}

When it happens

Trigger: POSTing the update form with newUsername filled but newPassword empty (or vice versa); a frontend client that omits empty fields via JSON omitting instead of sending them.

Common situations: UI forms that treat the password box as optional; API scripts that only update one credential; whitespace-only values after trim.

Related errors

• The current username or password is invalid
• telegram bot disabled
• tg_id must be a positive integer
• token not found
• invalid metric

AI-assisted analysis of MHSanaei/3x-ui@ad32144c42 (2026-08-15). Data as JSON: /api/errors/576e8380e4834149. Report an issue: GitHub.