{"record":{"id":"48134e8ee7abafab","repo":"elunez/eladmin","slug":"error-48134e","errorCode":null,"errorMessage":"不能修改他人资料","messagePattern":"不能修改他人资料","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"eladmin-system/src/main/java/me/zhengjie/modules/system/rest/UserController.java","lineNumber":133,"sourceCode":"        return new ResponseEntity<>(HttpStatus.CREATED);\n    }\n\n    @Log(\"修改用户\")\n    @ApiOperation(\"修改用户\")\n    @PutMapping\n    @PreAuthorize(\"@el.check('user:edit')\")\n    public ResponseEntity<Object> updateUser(@Validated(User.Update.class) @RequestBody User resources) throws Exception {\n        checkLevel(resources);\n        userService.update(resources);\n        return new ResponseEntity<>(HttpStatus.NO_CONTENT);\n    }\n\n    @Log(\"修改用户：个人中心\")\n    @ApiOperation(\"修改用户：个人中心\")\n    @PutMapping(value = \"center\")\n    public ResponseEntity<Object> centerUser(@Validated(User.Update.class) @RequestBody User resources){\n        if(!resources.getId().equals(SecurityUtils.getCurrentUserId())){\n            throw new BadRequestException(\"不能修改他人资料\");\n        }\n        userService.updateCenter(resources);\n        return new ResponseEntity<>(HttpStatus.NO_CONTENT);\n    }\n\n    @Log(\"删除用户\")\n    @ApiOperation(\"删除用户\")\n    @DeleteMapping\n    @PreAuthorize(\"@el.check('user:del')\")\n    public ResponseEntity<Object> deleteUser(@RequestBody Set<Long> ids){\n        for (Long id : ids) {\n            Integer currentLevel =  Collections.min(roleService.findByUsersId(SecurityUtils.getCurrentUserId()).stream().map(RoleSmallDto::getLevel).collect(Collectors.toList()));\n            Integer optLevel =  Collections.min(roleService.findByUsersId(id).stream().map(RoleSmallDto::getLevel).collect(Collectors.toList()));\n            if (currentLevel > optLevel) {\n                throw new BadRequestException(\"角色权限不足，不能删除：\" + userService.findById(id).getUsername());\n            }\n        }\n        userService.delete(ids);","sourceCodeStart":115,"sourceCodeEnd":151,"githubUrl":"https://github.com/elunez/eladmin/blob/55fbf705956949697dbd68bf9003776609d3d029/eladmin-system/src/main/java/me/zhengjie/modules/system/rest/UserController.java#L115-L151","documentation":"Thrown by UserController.centerUser (line 133) on PUT /api/users/center when the id in the body does not equal SecurityUtils.getCurrentUserId(). The personal-center endpoint is intentionally self-service only: even holders of user:edit cannot use it to modify another account. The comparison is done on the JWT-derived id, so the body id must match the token's subject exactly.","triggerScenarios":"Front-end personal-center page posting a stale user object after the account re-logged-in as someone else; token refreshed but the locally cached user id not; a crafted request trying to edit another user's nickname/phone via the center endpoint (correctly blocked).","commonSituations":"Local storage holding an old user object after switching accounts in the same browser; front-end caching the profile separately from the token; testers probing the endpoint with arbitrary ids.","solutions":["Always send the current token's user id: fetch the profile from GET /api/users/info and post back its id unchanged.","After login/logout, clear cached profile state (Vuex/localStorage) so the center form cannot hold a previous account's id.","To administer another user, use PUT /api/users (updateUser) with user:edit permission instead of /center."],"exampleFix":"// before\naxios.put('/api/users/center', this.storedProfile) // id from stale storage\n// after\nconst { data: me } = await axios.get('/api/users/info');\naxios.put('/api/users/center', { ...this.form, id: me.user.id })","handlingStrategy":"validation","validationCode":"const me = store.state.user.user; // source of truth = token subject\nif (form.id !== me.id) form.id = me.id; // hard-sync before submit\nawait axios.put('/api/users/center', form);","typeGuard":"const isSelfEdit = (formId, currentUserId) => formId === currentUserId;","tryCatchPattern":null,"preventionTips":["Derive the center form's id from the login response, never from long-lived storage.","Clear profile state on logout.","Use the admin update endpoint for managing other users."],"tags":["authorization","self-service","eladmin","user","personal-center"],"backgroundTag":null,"analyzedSha":"55fbf705956949697dbd68bf9003776609d3d029","analyzedAt":"2026-08-14T11:56:12.758Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}