{"record":{"id":"e9159473c00f5720","repo":"jeecgboot/JeecgBoot","slug":"admin-e91594","errorCode":null,"errorMessage":"admin用户，不允许删除！","messagePattern":"admin用户，不允许删除！","errorType":"exception","errorClass":"JeecgBootException","httpStatus":null,"severity":"error","filePath":"jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/service/impl/SysUserServiceImpl.java","lineNumber":2067,"sourceCode":"\t\t// 代码逻辑说明: 【QQYUN-8425】用户导入成功后 消息提醒 跳转至同意页面---\n\t\tdata.put(CommonConstant.NOTICE_MSG_BUS_TYPE,SysAnnmentTypeEnum.TENANT_INVITE.getType());\n\t\tmessageDTO.setData(data);\n\t\tmessageDTO.setContent(title);\n\t\tmessageDTO.setToUser(invitedUsername);\n\t\tmessageDTO.setFromUser(\"system\");\n\t\tsystemSendMsgHandle.sendMessage(messageDTO);\n\t}\n\t//======================================= end 用户与部门 用户列表导入 =========================================\n\t\n\t@Override\n\tpublic void checkUserAdminRejectDel(String userIds) {\n\t\tLambdaQueryWrapper<SysUser> query = new LambdaQueryWrapper<>();\n\t\tquery.in(SysUser::getId,Arrays.asList(userIds.split(SymbolConstant.COMMA)));\n\t\tquery.eq(SysUser::getUsername,\"admin\");\n\t\tLong adminRoleCount = this.baseMapper.selectCount(query);\n\t\t//大于0说明存在管理员用户，不允许删除\n\t\tif(adminRoleCount>0){\n\t\t\tthrow new JeecgBootException(\"admin用户，不允许删除！\");\n\t\t}\n\t}\n\n\t@Override\n\tpublic void changePhone(JSONObject json, String username) {\n\t\tString smscode = json.getString(\"smscode\");\n\t\tString phone = json.getString(\"phone\");\n\t\tString type = json.getString(\"type\");\n\t\tif(oConvertUtils.isEmpty(phone)){\n\t\t\tthrow new JeecgBootException(\"请填写原手机号！\");\n\t\t}\n\t\tif(oConvertUtils.isEmpty(smscode)){\n\t\t\tthrow new JeecgBootException(\"请填写验证码！\");\n\t\t}\n\t\t//step1 验证原手机号是否和当前用户匹配\n\t\tSysUser sysUser = userMapper.getUserByNameAndPhone(phone,username);\n\t\tif (null == sysUser){\n\t\t\tthrow new JeecgBootException(\"原手机号不匹配，无法修改密码！\");","sourceCodeStart":2049,"sourceCodeEnd":2085,"githubUrl":"https://github.com/jeecgboot/JeecgBoot/blob/96fb33f5ec68516da0b0147da06b2eb0419e063a/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/service/impl/SysUserServiceImpl.java#L2049-L2085","documentation":"Thrown by SysUserServiceImpl.checkUserAdminRejectDel. It queries sys_user for rows matching the given userIds AND username='admin'; if any exist, deletion is blocked to protect the built-in administrator.","triggerScenarios":"A delete-users request whose userIds list includes the id of the user whose username is 'admin'.","commonSituations":"Bulk delete selected all users including admin; admin's id leaked into a comma-separated list; a second account was renamed to 'admin' (unlikely, usually prohibited); UI did not exclude admin from the selectable set.","solutions":["Exclude admin's userId from the delete request before submitting.","In the UI, make admin non-selectable or filter it from bulk-select.","If a non-system account was mistakenly named 'admin', rename it before deleting.","Audit the userIds list payload to confirm which id triggers it."],"exampleFix":"// before\nuserIds = selectedIds.stream().collect(joining(\",\")); // includes admin id\ncheckUserAdminRejectDel(userIds);\n\n// after: strip admin id\nList<String> safe = selectedIds.stream().filter(id -> !adminId.equals(id)).collect(toList());\ncheckUserAdminRejectDel(String.join(\",\", safe));","handlingStrategy":"validation","validationCode":"SysUser admin = userMapper.selectOne(new LambdaQueryWrapper<SysUser>().eq(SysUser::getUsername, \"admin\"));\nList<String> safe = Arrays.asList(userIds.split(\",\")).stream()\n    .filter(id -> !id.equals(admin.getId())).collect(Collectors.toList());\nif (safe.isEmpty()) return Result.error(\"无可删除用户\");","typeGuard":"boolean excludesAdmin(String userIds, String adminId) {\n  return !Arrays.asList(userIds.split(\",\")).contains(adminId);\n}","tryCatchPattern":"try { userService.checkUserAdminRejectDel(userIds); }\ncatch (JeecgBootException e) {\n  if (e.getMessage().contains(\"admin\")) return Result.error(\"不能删除超级管理员\");\n  throw e;\n}","preventionTips":["Make admin non-selectable in the UI.","Strip admin id from bulk-delete payloads server-side.","Never reuse the username 'admin' for other accounts."],"tags":["user-management","admin","protection","validation"],"backgroundTag":null,"analyzedSha":"96fb33f5ec68516da0b0147da06b2eb0419e063a","analyzedAt":"2026-08-14T00:04:16.786Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}