{"record":{"id":"d08141c6c8579aa2","repo":"vaxilu/x-ui","slug":"error","errorCode":null,"errorMessage":"原用户名或原密码错误","messagePattern":"原用户名或原密码错误","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"web/controller/setting.go","lineNumber":69,"sourceCode":"\terr := c.ShouldBind(allSetting)\n\tif err != nil {\n\t\tjsonMsg(c, \"修改设置\", err)\n\t\treturn\n\t}\n\terr = a.settingService.UpdateAllSetting(allSetting)\n\tjsonMsg(c, \"修改设置\", err)\n}\n\nfunc (a *SettingController) updateUser(c *gin.Context) {\n\tform := &updateUserForm{}\n\terr := c.ShouldBind(form)\n\tif err != nil {\n\t\tjsonMsg(c, \"修改用户\", err)\n\t\treturn\n\t}\n\tuser := session.GetLoginUser(c)\n\tif user.Username != form.OldUsername || user.Password != form.OldPassword {\n\t\tjsonMsg(c, \"修改用户\", errors.New(\"原用户名或原密码错误\"))\n\t\treturn\n\t}\n\tif form.NewUsername == \"\" || form.NewPassword == \"\" {\n\t\tjsonMsg(c, \"修改用户\", errors.New(\"新用户名和新密码不能为空\"))\n\t\treturn\n\t}\n\terr = a.userService.UpdateUser(user.Id, form.NewUsername, form.NewPassword)\n\tif err == nil {\n\t\tuser.Username = form.NewUsername\n\t\tuser.Password = form.NewPassword\n\t\tsession.SetLoginUser(c, user)\n\t}\n\tjsonMsg(c, \"修改用户\", err)\n}\n\nfunc (a *SettingController) restartPanel(c *gin.Context) {\n\terr := a.panelService.RestartPanel(time.Second * 3)\n\tjsonMsg(c, \"重启面板\", err)","sourceCodeStart":51,"sourceCodeEnd":87,"githubUrl":"https://github.com/vaxilu/x-ui/blob/9c1be8c57a53953b47ee7c09a93554e73816f907/web/controller/setting.go#L51-L87","documentation":"This error is thrown by updateUser in web/controller/setting.go when the currently logged-in user's stored username or password does not match the OldUsername/OldPassword values submitted in the form. It is a deliberate re-authentication check: the app requires the user to confirm their existing credentials before allowing a username/password change. The comparison is done on plain string equality (user.Password != form.OldPassword), so any mismatch produces this error and the update is aborted.","triggerScenarios":"POSTing the update-user settings form with an OldUsername that differs from session user's username, or an OldPassword string that is not exactly equal to the stored user.Password (including whitespace or casing differences). Also occurs if the session user object is stale relative to recent credential changes.","commonSituations":"A user typoing their old password when changing credentials; a user whose password was changed in another session/tab leaving the form pre-filled with the old value; administrators copying the wrong account's credentials; typing the new password into the old-password field.","solutions":["Enter the exact current username and password of the logged-in account in the OldUsername/OldPassword fields","Re-login to refresh the session user object, then retry the change","If the old password is forgotten, reset it via the password-reset/admin flow instead of this form","Trim input and disable browser autofill for the old-password field to avoid stale autofilled values"],"exampleFix":"// before\nif user.Username != form.OldUsername || user.Password != form.OldPassword {\n    jsonMsg(c, \"修改用户\", errors.New(\"原用户名或原密码错误\"))\n    return\n}\n// after\nform.OldUsername = strings.TrimSpace(form.OldUsername)\nform.OldPassword = strings.TrimSpace(form.OldPassword)\nif user.Username != form.OldUsername || user.Password != form.OldPassword {\n    jsonMsg(c, \"修改用户\", errors.New(\"原用户名或原密码错误\"))\n    return\n}","handlingStrategy":"validation","validationCode":"if user.Username != form.OldUsername || user.Password != form.OldPassword {\n    // abort: do not call UpdateUser\n    jsonMsg(c, \"修改用户\", errors.New(\"原用户名或原密码错误\"))\n    return\n}","typeGuard":null,"tryCatchPattern":"if err := updateUserFlow(c, form); err != nil {\n    if err.Error() == \"原用户名或原密码错误\" {\n        c.JSON(401, gin.H{\"msg\": \"old credentials do not match\"})\n        return\n    }\n    c.JSON(500, gin.H{\"msg\": err.Error()})\n}","preventionTips":["Always confirm the old password explicitly before a credential change (re-auth pattern)","Trim and normalize form inputs before comparison","Refresh the session user after any credential change elsewhere","Never allow the client to send only new credentials without old ones"],"tags":["auth","validation","user-management"],"backgroundTag":"invalid-credentials","analyzedSha":"9c1be8c57a53953b47ee7c09a93554e73816f907","analyzedAt":"2026-09-02T18:46:17.308Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T21:17:11.164Z"}