{"record":{"id":"fe44d924e3f84d6e","repo":"elunez/eladmin","slug":"error-fe44d9","errorCode":null,"errorMessage":"密码错误","messagePattern":"密码错误","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"eladmin-system/src/main/java/me/zhengjie/modules/system/rest/UserController.java","lineNumber":192,"sourceCode":"        String pwd = passwordEncoder.encode(\"123456\");\n        userService.resetPwd(ids, pwd);\n        return new ResponseEntity<>(HttpStatus.OK);\n    }\n\n    @ApiOperation(\"修改头像\")\n    @PostMapping(value = \"/updateAvatar\")\n    public ResponseEntity<Object> updateUserAvatar(@RequestParam MultipartFile avatar){\n        return new ResponseEntity<>(userService.updateAvatar(avatar), HttpStatus.OK);\n    }\n\n    @Log(\"修改邮箱\")\n    @ApiOperation(\"修改邮箱\")\n    @PostMapping(value = \"/updateEmail/{code}\")\n    public ResponseEntity<Object> updateUserEmail(@PathVariable String code,@RequestBody User user) throws Exception {\n        String password = RsaUtils.decryptByPrivateKey(RsaProperties.privateKey,user.getPassword());\n        UserDto userDto = userService.findByName(SecurityUtils.getCurrentUsername());\n        if(!passwordEncoder.matches(password, userDto.getPassword())){\n            throw new BadRequestException(\"密码错误\");\n        }\n        verificationCodeService.validated(CodeEnum.EMAIL_RESET_EMAIL_CODE.getKey() + user.getEmail(), code);\n        userService.updateEmail(userDto.getUsername(),user.getEmail());\n        return new ResponseEntity<>(HttpStatus.OK);\n    }\n\n    /**\n     * 如果当前用户的角色级别低于创建用户的角色级别，则抛出权限不足的错误\n     * @param resources /\n     */\n    private void checkLevel(User resources) {\n        Integer currentLevel =  Collections.min(roleService.findByUsersId(SecurityUtils.getCurrentUserId()).stream().map(RoleSmallDto::getLevel).collect(Collectors.toList()));\n        Integer optLevel = roleService.findByRoles(resources.getRoles());\n        if (currentLevel > optLevel) {\n            throw new BadRequestException(\"角色权限不足\");\n        }\n    }\n}","sourceCodeStart":174,"sourceCodeEnd":210,"githubUrl":"https://github.com/elunez/eladmin/blob/55fbf705956949697dbd68bf9003776609d3d029/eladmin-system/src/main/java/me/zhengjie/modules/system/rest/UserController.java#L174-L210","documentation":"Thrown by UserController.updateUserEmail (line 192) on POST /api/users/updateEmail/{code} when the RSA-decrypted password in the body does not match the current user's stored hash. Changing email requires re-authentication: password + an email verification code. Like updatePass, the password travels RSA-encrypted, so a front-end/back-end key mismatch also manifests as this error.","triggerScenarios":"User mistypes their password on the change-email dialog; RSA keypair rotated on the server while the browser still encrypts with the old public key; user changed password in another session and enters the outdated one; email change attempted with the password field left as the masked display value.","commonSituations":"Front-end form sending the display-masked password instead of the typed one; stale cached RSA public key in the SPA; verification-code dialog reused after a password rotation.","solutions":["Re-enter the current login password (not the previous one) and retry with a fresh email code.","If it consistently fails, verify the RSA keypair matches between front end (jsencrypt public key) and RsaProperties.privateKey on the server.","Ensure the password input is sent RSA-encrypted by the client exactly like the updatePass flow."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if (!password) { notifyError('请输入当前密码'); return; }\nawait axios.post(`/api/users/updateEmail/${code}`, {\n  password: encrypt(password), // RSA, same keypair as updatePass\n  email: newEmail,\n});","typeGuard":null,"tryCatchPattern":"Catch 400 on /updateEmail/{code}; distinguish '密码错误' from code-validation failures and target the correct form field.","preventionTips":["Request the password fresh in the dialog; never prefill with a masked value.","Verify email verification code is still valid before submitting (expired codes produce a different error but same flow).","Keep RSA keypair consistent between front end and server."],"tags":["authentication","email","rsa","eladmin","user","verification-code"],"backgroundTag":null,"analyzedSha":"55fbf705956949697dbd68bf9003776609d3d029","analyzedAt":"2026-08-14T11:56:12.758Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}