{"record":{"id":"21381a2553d55d6e","repo":"MHSanaei/3x-ui","slug":"the-current-username-or-password-is-invalid","errorCode":null,"errorMessage":"The current username or password is invalid","messagePattern":"The current username or password is invalid","errorType":"validation","errorClass":null,"httpStatus":200,"severity":"warning","filePath":"internal/web/controller/setting.go","lineNumber":180,"sourceCode":"\t\t\t\toldTgAPIServer != allSetting.TgBotAPIServer))\n\t\tif tgChanged {\n\t\t\treloadTgbotFunc()\n\t\t}\n\t}\n\tjsonMsg(c, I18nWeb(c, \"pages.settings.toasts.modifySettings\"), err)\n}\n\n// updateUser updates the current user's username and password.\nfunc (a *SettingController) updateUser(c *gin.Context) {\n\tform := &updateUserForm{}\n\terr := c.ShouldBind(form)\n\tif err != nil {\n\t\tjsonMsg(c, I18nWeb(c, \"pages.settings.toasts.modifySettings\"), err)\n\t\treturn\n\t}\n\tuser := session.GetLoginUser(c)\n\tif user.Username != form.OldUsername || !crypto.CheckPasswordHash(user.Password, form.OldPassword) {\n\t\tjsonMsg(c, I18nWeb(c, \"pages.settings.toasts.modifyUserError\"), errors.New(I18nWeb(c, \"pages.settings.toasts.originalUserPassIncorrect\")))\n\t\treturn\n\t}\n\tif form.NewUsername == \"\" || form.NewPassword == \"\" {\n\t\tjsonMsg(c, I18nWeb(c, \"pages.settings.toasts.modifyUserError\"), errors.New(I18nWeb(c, \"pages.settings.toasts.userPassMustBeNotEmpty\")))\n\t\treturn\n\t}\n\tif err := a.settingService.VerifyTwoFactorCode(form.TwoFactorCode); err != nil {\n\t\tjsonMsg(c, I18nWeb(c, \"pages.settings.toasts.modifyUserError\"), err)\n\t\treturn\n\t}\n\terr = a.userService.UpdateUser(user.Id, form.NewUsername, form.NewPassword)\n\tif err == nil {\n\t\tuser.Username = form.NewUsername\n\t\tuser.Password, _ = crypto.HashPasswordAsBcrypt(form.NewPassword)\n\t\tif saveErr := session.SetLoginUser(c, user); saveErr != nil {\n\t\t\terr = saveErr\n\t\t}\n\t}","sourceCodeStart":162,"sourceCodeEnd":198,"githubUrl":"https://github.com/MHSanaei/3x-ui/blob/ad32144c42455696ea9f14e12168beac3e25f5d2/internal/web/controller/setting.go#L162-L198","documentation":"The updateUser handler rejects the change because the presented old username does not match the session user's username OR the old password fails bcrypt verification (crypto.CheckPasswordHash). The visible text comes from the i18n key pages.settings.toasts.originalUserPassIncorrect. It is an authentication gate on credential rotation, separate from 2FA which is checked later.","triggerScenarios":"POST to the settings update endpoint with a stale username (e.g. changed in another tab), a typo'd old password, or autofill inserting the wrong value into oldUsername/oldPassword form fields.","commonSituations":"Password managers autofilling the wrong credential pair; the user editing credentials after an admin already renamed the account; leading/trailing whitespace from copy-paste.","solutions":["Re-enter the current (pre-change) username and password exactly as stored — not the new values","Check for stray whitespace/newlines from paste or autofill","If genuinely forgotten, reset from the CLI/DB side (admin path) rather than retrying the form","Confirm the session itself is not stale (re-login) before retrying"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":["Have the form send the CURRENT username/password in the old fields, not the new ones","Disable password-manager autofill on the old-credential inputs","Show a distinct 'current credentials incorrect' message so users know which pair failed"],"tags":["authentication","settings","i18n","api"],"backgroundTag":null,"analyzedSha":"ad32144c42455696ea9f14e12168beac3e25f5d2","analyzedAt":"2026-08-15T11:13:23.905Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}