{"record":{"id":"132671b4f399c0b8","repo":"vaxilu/x-ui","slug":"error-132671","errorCode":null,"errorMessage":"新用户名和新密码不能为空","messagePattern":"新用户名和新密码不能为空","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"web/controller/setting.go","lineNumber":73,"sourceCode":"\t}\n\terr = a.settingService.UpdateAllSetting(allSetting)\n\tjsonMsg(c, \"修改设置\", err)\n}\n\nfunc (a *SettingController) updateUser(c *gin.Context) {\n\tform := &updateUserForm{}\n\terr := c.ShouldBind(form)\n\tif err != nil {\n\t\tjsonMsg(c, \"修改用户\", err)\n\t\treturn\n\t}\n\tuser := session.GetLoginUser(c)\n\tif user.Username != form.OldUsername || user.Password != form.OldPassword {\n\t\tjsonMsg(c, \"修改用户\", errors.New(\"原用户名或原密码错误\"))\n\t\treturn\n\t}\n\tif form.NewUsername == \"\" || form.NewPassword == \"\" {\n\t\tjsonMsg(c, \"修改用户\", errors.New(\"新用户名和新密码不能为空\"))\n\t\treturn\n\t}\n\terr = a.userService.UpdateUser(user.Id, form.NewUsername, form.NewPassword)\n\tif err == nil {\n\t\tuser.Username = form.NewUsername\n\t\tuser.Password = form.NewPassword\n\t\tsession.SetLoginUser(c, user)\n\t}\n\tjsonMsg(c, \"修改用户\", err)\n}\n\nfunc (a *SettingController) restartPanel(c *gin.Context) {\n\terr := a.panelService.RestartPanel(time.Second * 3)\n\tjsonMsg(c, \"重启面板\", err)\n}\n","sourceCodeStart":55,"sourceCodeEnd":89,"githubUrl":"https://github.com/vaxilu/x-ui/blob/9c1be8c57a53953b47ee7c09a93554e73816f907/web/controller/setting.go#L55-L89","documentation":"Thrown by updateUser when the submitted form passes the old-credential check but NewUsername or NewPassword is an empty string. The service refuses to write blank credentials because UpdateUser would otherwise overwrite a valid account with empty values, which could lock the user out. It is a guard against destructive empty-string updates.","triggerScenarios":"Submitting the update-user form with only OldUsername/OldPassword filled and one or both of NewUsername/NewPassword left blank; a client sending a JSON/form body omitting the new credential fields (Go decodes missing fields as \"\").","commonSituations":"Users clicking save after clearing the new-password field; API/scripts calling the endpoint with partial payloads; frontend form validation not enforcing required fields before submission.","solutions":["Fill in both the new username and new password before submitting","Add client-side required-field validation so empty submissions never reach the server","If calling the API directly, include non-empty newUsername and newPassword in the request body"],"exampleFix":"// before (client sends partial payload)\nfetch('/setting/updateUser', {method:'POST', body: {oldUsername, oldPassword}})\n// after\nif (!newUsername || !newPassword) { alert('新用户名和新密码不能为空'); return; }\nfetch('/setting/updateUser', {method:'POST', body: {oldUsername, oldPassword, newUsername, newPassword}})","handlingStrategy":"validation","validationCode":"if form.NewUsername == \"\" || form.NewPassword == \"\" {\n    return errors.New(\"新用户名和新密码不能为空\")\n}","typeGuard":null,"tryCatchPattern":"if err := updateUserFlow(c, form); err != nil {\n    if err.Error() == \"新用户名和新密码不能为空\" {\n        c.JSON(400, gin.H{\"msg\": \"new username and password are required\"})\n        return\n    }\n    c.JSON(500, gin.H{\"msg\": err.Error()})\n}","preventionTips":["Mark new username/password as required in the frontend form","Use struct binding tags like binding:\"required\" server-side","Never submit the form until all fields pass client validation","For API callers, validate payload completeness before sending"],"tags":["validation","user-management","empty-input"],"backgroundTag":"missing-required-argument","analyzedSha":"9c1be8c57a53953b47ee7c09a93554e73816f907","analyzedAt":"2026-09-02T18:46:17.308Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T21:17:11.164Z"}