{"record":{"id":"21c25cb254b0bcad","repo":"elunez/eladmin","slug":"error-21c25c","errorCode":null,"errorMessage":"修改失败，旧密码错误","messagePattern":"修改失败，旧密码错误","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"eladmin-system/src/main/java/me/zhengjie/modules/system/rest/UserController.java","lineNumber":162,"sourceCode":"        for (Long id : ids) {\n            Integer currentLevel =  Collections.min(roleService.findByUsersId(SecurityUtils.getCurrentUserId()).stream().map(RoleSmallDto::getLevel).collect(Collectors.toList()));\n            Integer optLevel =  Collections.min(roleService.findByUsersId(id).stream().map(RoleSmallDto::getLevel).collect(Collectors.toList()));\n            if (currentLevel > optLevel) {\n                throw new BadRequestException(\"角色权限不足，不能删除：\" + userService.findById(id).getUsername());\n            }\n        }\n        userService.delete(ids);\n        return new ResponseEntity<>(HttpStatus.OK);\n    }\n\n    @ApiOperation(\"修改密码\")\n    @PostMapping(value = \"/updatePass\")\n    public ResponseEntity<Object> updateUserPass(@RequestBody UserPassVo passVo) throws Exception {\n        String oldPass = RsaUtils.decryptByPrivateKey(RsaProperties.privateKey,passVo.getOldPass());\n        String newPass = RsaUtils.decryptByPrivateKey(RsaProperties.privateKey,passVo.getNewPass());\n        UserDto user = userService.findByName(SecurityUtils.getCurrentUsername());\n        if(!passwordEncoder.matches(oldPass, user.getPassword())){\n            throw new BadRequestException(\"修改失败，旧密码错误\");\n        }\n        if(passwordEncoder.matches(newPass, user.getPassword())){\n            throw new BadRequestException(\"新密码不能与旧密码相同\");\n        }\n        userService.updatePass(user.getUsername(),passwordEncoder.encode(newPass));\n        return new ResponseEntity<>(HttpStatus.OK);\n    }\n\n    @ApiOperation(\"重置密码\")\n    @PutMapping(value = \"/resetPwd\")\n    public ResponseEntity<Object> resetPwd(@RequestBody Set<Long> ids) {\n        String pwd = passwordEncoder.encode(\"123456\");\n        userService.resetPwd(ids, pwd);\n        return new ResponseEntity<>(HttpStatus.OK);\n    }\n\n    @ApiOperation(\"修改头像\")\n    @PostMapping(value = \"/updateAvatar\")","sourceCodeStart":144,"sourceCodeEnd":180,"githubUrl":"https://github.com/elunez/eladmin/blob/55fbf705956949697dbd68bf9003776609d3d029/eladmin-system/src/main/java/me/zhengjie/modules/system/rest/UserController.java#L144-L180","documentation":"Thrown by UserController.updateUserPass (line 162) on POST /api/users/updatePass when passwordEncoder.matches(oldPass, user.getPassword()) is false. The submitted oldPass was RSA-decrypted with the server private key first, so a mismatch means either the password is genuinely wrong, the RSA keypair changed since the front end encrypted it, or the browser sent an already-hashed value.","triggerScenarios":"User typos the old password; server's RsaProperties.privateKey regenerated/redeployed so the front-end-encrypted oldPass decrypts to garbage; user already changed the password in another tab/session and repeats the outdated old password; client posting plaintext while keys expect RSA-encrypted payloads (or vice versa after a key rotation).","commonSituations":"Front-end and back-end RSA public/private key mismatch after re-generating keys or copying config between environments; password changed elsewhere with stale form state; old browsers caching the old public key.","solutions":["Have the user retype the old password carefully — the simple and most common cause.","If EVERY attempt fails, verify the RSA keypair: the front-end jsencrypt public key must match eladmin's RsaProperties (config/RsaProperties, default eladmin key). Re-sync and hard-refresh the front end.","Confirm the client encrypts oldPass/newPass with the public key before sending — the controller decrypts unconditionally.","As admin, reset the user's password via PUT /api/users/resetPwd if the user is locked out."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Basic client check before calling updatePass\nif (!oldPass || !newPass) { notifyError('请填写完整'); return; }\nif (oldPass === newPass) { notifyError('新密码不能与旧密码相同'); return; }\nawait axios.post('/api/users/updatePass', {\n  oldPass: encrypt(oldPass), // RSA public key, same as backend keypair\n  newPass: encrypt(newPass),\n});","typeGuard":null,"tryCatchPattern":"Catch 400 from /updatePass and map message to the form field (old-password error near the old input); never auto-retry.","preventionTips":["Keep the front-end RSA public key in sync with RsaProperties on the server.","Validate non-empty old/new client-side before the round trip.","Admins: use /resetPwd as the recovery path for locked-out users."],"tags":["authentication","password","rsa","eladmin","user"],"backgroundTag":null,"analyzedSha":"55fbf705956949697dbd68bf9003776609d3d029","analyzedAt":"2026-08-14T11:56:12.758Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}