{"record":{"id":"a6ae0116ebcf7a75","repo":"MHSanaei/3x-ui","slug":"username-can-not-be-empty","errorCode":null,"errorMessage":"username can not be empty","messagePattern":"username can not be empty","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"internal/web/service/panel/user.go","lineNumber":145,"sourceCode":"\n\tif twoFactorEnable {\n\t\t_ = s.settingService.SetTwoFactorEnable(false)\n\t\t_ = s.settingService.SetTwoFactorToken(\"\")\n\t}\n\n\treturn db.Model(model.User{}).\n\t\tWhere(\"id = ?\", id).\n\t\tUpdates(map[string]any{\n\t\t\t\"username\":    username,\n\t\t\t\"password\":    hashedPassword,\n\t\t\t\"login_epoch\": gorm.Expr(\"login_epoch + 1\"),\n\t\t}).\n\t\tError\n}\n\nfunc (s *UserService) UpdateFirstUser(username string, password string) error {\n\tif username == \"\" {\n\t\treturn errors.New(\"username can not be empty\")\n\t} else if password == \"\" {\n\t\treturn errors.New(\"password can not be empty\")\n\t}\n\thashedPassword, er := crypto.HashPasswordAsBcrypt(password)\n\n\tif er != nil {\n\t\treturn er\n\t}\n\n\tdb := database.GetDB()\n\tuser := &model.User{}\n\terr := db.Model(model.User{}).First(user).Error\n\tif database.IsNotFound(err) {\n\t\tuser.Username = username\n\t\tuser.Password = hashedPassword\n\t\treturn db.Model(model.User{}).Create(user).Error\n\t} else if err != nil {\n\t\treturn err","sourceCodeStart":127,"sourceCodeEnd":163,"githubUrl":"https://github.com/MHSanaei/3x-ui/blob/ad32144c42455696ea9f14e12168beac3e25f5d2/internal/web/service/panel/user.go#L127-L163","documentation":"UpdateFirstUser in internal/web/service/panel/user.go updates the first (admin) user record; it rejects an empty username string before touching the database. The username doubles as the admin login name, so an empty value would lock everyone out of the panel.","triggerScenarios":"Calling service.UpdateFirstUser(\"\", password) — e.g. a settings-update API request where the username field was omitted from the JSON payload and defaulted to \"\", or a CLI/script invoking the setter with an unset variable.","commonSituations":"Frontend form submitted without the username field; automation script passing an empty shell variable (unquoted $USER_VAR); API client built from a struct where Username was never set.","solutions":["Send a non-empty username in the request payload that reaches UpdateFirstUser","On the caller side, default or validate the field before calling the service (fail fast at the API boundary)","If driven by a script, quote and check the variable: [ -n \"$USERNAME\" ] before invoking"],"exampleFix":"// before\nerr := userService.UpdateFirstUser(\"\", \"newpass\")\n\n// after\nif username == \"\" {\n    return fmt.Errorf(\"username required\")\n}\nerr := userService.UpdateFirstUser(username, \"newpass\")","handlingStrategy":"validation","validationCode":"if strings.TrimSpace(username) == \"\" {\n    return errors.New(\"username required\")\n}\nerr := userService.UpdateFirstUser(username, password)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate non-empty username at the API boundary before calling the service","Reject the whole request early instead of relying on the service guard","Treat empty-string form fields as missing, not as valid values"],"tags":["validation","admin","user-management"],"backgroundTag":null,"analyzedSha":"ad32144c42455696ea9f14e12168beac3e25f5d2","analyzedAt":"2026-08-15T11:13:23.905Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}