{"record":{"id":"c8cc1233282e8381","repo":"vaxilu/x-ui","slug":"password-can-not-be-empty","errorCode":null,"errorMessage":"password can not be empty","messagePattern":"password can not be empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"web/service/user.go","lineNumber":58,"sourceCode":"\t\treturn nil\n\t}\n\treturn user\n}\n\nfunc (s *UserService) UpdateUser(id int, username string, password string) error {\n\tdb := database.GetDB()\n\treturn db.Model(model.User{}).\n\t\tWhere(\"id = ?\", id).\n\t\tUpdate(\"username\", username).\n\t\tUpdate(\"password\", password).\n\t\tError\n}\n\nfunc (s *UserService) UpdateFirstUser(username string, password string) error {\n\tif username == \"\" {\n\t\treturn errors.New(\"username can not be empty\")\n\t} else if password == \"\" {\n\t\treturn errors.New(\"password can not be empty\")\n\t}\n\tdb := database.GetDB()\n\tuser := &model.User{}\n\terr := db.Model(model.User{}).First(user).Error\n\tif database.IsNotFound(err) {\n\t\tuser.Username = username\n\t\tuser.Password = password\n\t\treturn db.Model(model.User{}).Create(user).Error\n\t} else if err != nil {\n\t\treturn err\n\t}\n\tuser.Username = username\n\tuser.Password = password\n\treturn db.Save(user).Error\n}\n","sourceCodeStart":40,"sourceCodeEnd":74,"githubUrl":"https://github.com/vaxilu/x-ui/blob/9c1be8c57a53953b47ee7c09a93554e73816f907/web/service/user.go#L40-L74","documentation":"UpdateFirstUser returns this error when the password argument is an empty string. Just like the username check, the service refuses to persist a blank password because doing so would effectively disable authentication for the first user account. The validation happens before any DB write.","triggerScenarios":"Calling UpdateFirstUser(username, \"\"), typically from updateSetting when the settings form had an empty password value passed through unchanged.","commonSituations":"User submitting the settings page without typing a new password; scripts calling the API with a missing password key; password managers autofilling only the username.","solutions":["Supply a non-empty password when calling UpdateFirstUser","Add binding:\"required\" (or min length) validation on the password field in the handler form","Enforce a minimum password length in client-side validation to reject whitespace-only values too"],"exampleFix":"// before\nerr := a.userService.UpdateFirstUser(form.Username, form.Password)\n// after\nif strings.TrimSpace(form.Password) == \"\" {\n    jsonMsg(c, \"设置\", errors.New(\"password can not be empty\")); return\n}\nerr := a.userService.UpdateFirstUser(form.Username, form.Password)","handlingStrategy":"validation","validationCode":"if strings.TrimSpace(password) == \"\" {\n    return errors.New(\"password can not be empty\")\n}","typeGuard":null,"tryCatchPattern":"if err := userService.UpdateFirstUser(username, password); err != nil {\n    if err.Error() == \"password can not be empty\" {\n        c.JSON(400, gin.H{\"msg\": \"password is required\"})\n        return\n    }\n    c.JSON(500, gin.H{\"msg\": err.Error()})\n}","preventionTips":["Require a minimum password length in form validation","Reject whitespace-only passwords","Mark the password input required in the UI","Never pass form fields straight to the service without checks"],"tags":["validation","user-management","empty-input"],"backgroundTag":"missing-required-argument","analyzedSha":"9c1be8c57a53953b47ee7c09a93554e73816f907","analyzedAt":"2026-09-02T18:46:17.308Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T21:17:11.164Z"}