{"record":{"id":"474bbf512c8ccc88","repo":"jeecgboot/JeecgBoot","slug":"error-474bbf","errorCode":null,"errorMessage":"您输入的密码不正确，无法删除该用户！","messagePattern":"您输入的密码不正确，无法删除该用户！","errorType":"exception","errorClass":"JeecgBootException","httpStatus":null,"severity":"error","filePath":"jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/service/impl/SysTenantServiceImpl.java","lineNumber":952,"sourceCode":"     */\n    private void verifyCreateTimeAndPassword(SysUser sysUser,String password) {\n        if(null == sysUser){\n            throw new JeecgBootException(\"该用户不存在，无法删除！\");\n        }\n        //step1 验证创建时间\n        //当前登录用户\n        LoginUser user = (LoginUser) SecurityUtils.getSubject().getPrincipal();\n        Date createTime = sysUser.getCreateTime();\n        boolean sameDay = DateUtils.isSameDay(createTime, new Date());\n        if(!sameDay){\n            throw new JeecgBootException(\"用户不是今天创建的，无法删除！\");\n        }\n        //step2 验证密码\n        //获取admin的用户\n        SysUser adminUser = userService.getById(user.getId());\n        String passwordEncode = PasswordUtil.encrypt(adminUser.getUsername(), password, adminUser.getSalt());\n        if(!passwordEncode.equals(adminUser.getPassword())){\n            throw new JeecgBootException(\"您输入的密码不正确，无法删除该用户！\");\n        }\n    }\n\n    @Override\n    public List<SysTenant> getTenantListByUserId(String userId) {\n        return tenantMapper.getTenantListByUserId(userId);\n    }\n\n    @Override\n    public void deleteUser(SysUser sysUser, Integer tenantId) {\n        //被删除人的用户id\n        String userId = sysUser.getId();\n        //被删除人的密码\n        String password = sysUser.getPassword();\n        //当前登录用户\n        LoginUser user = (LoginUser) SecurityUtils.getSubject().getPrincipal();\n        //step1 判断当前用户是否为当前租户的创建者才可以删除\n        SysTenant sysTenant = this.getById(tenantId);","sourceCodeStart":934,"sourceCodeEnd":970,"githubUrl":"https://github.com/jeecgboot/JeecgBoot/blob/96fb33f5ec68516da0b0147da06b2eb0419e063a/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/service/impl/SysTenantServiceImpl.java#L934-L970","documentation":"Thrown by SysTenantServiceImpl.verifyCreateTimeAndPassword when deleting a tenant user. After confirming the target user was created today, the method re-authenticates the *current logged-in* user (the admin/tenant creator) by re-encrypting the submitted password with that admin's salt and comparing it to the stored hash. A mismatch raises this exception.","triggerScenarios":"Calling the tenant-user-delete flow with a password parameter that does not match the current login user's (admin's) actual password. The password is taken from the SysUser object passed into deleteUser and forwarded to verifyCreateTimeAndPassword.","commonSituations":"The frontend sends the wrong user's password, the admin changed their password recently and the cached form value is stale, the salt in the DB is out of sync with the stored hash, or PasswordUtil.encrypt logic changed between versions so re-encryption no longer matches.","solutions":["Confirm the password submitted is the password of the currently-authenticated user (LoginUser from SecurityUtils), not the target user being deleted.","Check that the admin user row has a consistent username+salt+password triple in sys_user table.","If PasswordUtil was upgraded, re-hash admin passwords or align the encrypt parameters (username, password, salt).","Verify the frontend delete-user form actually binds the logged-in admin's password into the request payload."],"exampleFix":"// before: payload carries target user's password\ndeleteUser(sysUser)  // sysUser.password = target user password\n\n// after: ensure the request carries the current admin's password\n// frontend form field = '当前登录用户密码', bound to sysUser.password\ndeleteUser(sysUser)  // sysUser.password = current admin password","handlingStrategy":"validation","validationCode":"// Before calling deleteUser, verify the admin's password client-side is the current user's\nLoginUser me = (LoginUser) SecurityUtils.getSubject().getPrincipal();\nSysUser admin = userService.getById(me.getId());\nString enc = PasswordUtil.encrypt(admin.getUsername(), password, admin.getSalt());\nif (!enc.equals(admin.getPassword())) {\n    return Result.error(\"请输入当前登录用户的正确密码\");\n}","typeGuard":"// ensure the SysUser passed to deleteUser carries a non-blank password\nboolean hasPwd = sysUser != null && sysUser.getPassword() != null && !sysUser.getPassword().isBlank();","tryCatchPattern":"try { sysTenantService.deleteUser(sysUser, tenantId); }\ncatch (JeecgBootException e) {\n  if (e.getMessage().contains(\"密码不正确\")) return Result.error(\"密码校验失败，请重新输入\");\n  throw e;\n}","preventionTips":["Always bind the delete-user password field to the logged-in admin's password, not the target user's.","Keep admin username/salt/password consistent in sys_user.","After password changes, invalidate cached form values."],"tags":["authentication","tenant","user-management","password"],"backgroundTag":null,"analyzedSha":"96fb33f5ec68516da0b0147da06b2eb0419e063a","analyzedAt":"2026-08-14T00:04:16.786Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}