What causes "修改失败，旧密码错误" in elunez/eladmin?

Have the user retype the old password carefully — the simple and most common cause.

elunez/eladmin · error · BadRequestException

修改失败，旧密码错误

Error message

修改失败，旧密码错误

What it means

Thrown by UserController.updateUserPass (line 162) on POST /api/users/updatePass when passwordEncoder.matches(oldPass, user.getPassword()) is false. The submitted oldPass was RSA-decrypted with the server private key first, so a mismatch means either the password is genuinely wrong, the RSA keypair changed since the front end encrypted it, or the browser sent an already-hashed value.

Source

Thrown at eladmin-system/src/main/java/me/zhengjie/modules/system/rest/UserController.java:162

        for (Long id : ids) {
            Integer currentLevel =  Collections.min(roleService.findByUsersId(SecurityUtils.getCurrentUserId()).stream().map(RoleSmallDto::getLevel).collect(Collectors.toList()));
            Integer optLevel =  Collections.min(roleService.findByUsersId(id).stream().map(RoleSmallDto::getLevel).collect(Collectors.toList()));
            if (currentLevel > optLevel) {
                throw new BadRequestException("角色权限不足，不能删除：" + userService.findById(id).getUsername());
            }
        }
        userService.delete(ids);
        return new ResponseEntity<>(HttpStatus.OK);
    }

    @ApiOperation("修改密码")
    @PostMapping(value = "/updatePass")
    public ResponseEntity<Object> updateUserPass(@RequestBody UserPassVo passVo) throws Exception {
        String oldPass = RsaUtils.decryptByPrivateKey(RsaProperties.privateKey,passVo.getOldPass());
        String newPass = RsaUtils.decryptByPrivateKey(RsaProperties.privateKey,passVo.getNewPass());
        UserDto user = userService.findByName(SecurityUtils.getCurrentUsername());
        if(!passwordEncoder.matches(oldPass, user.getPassword())){
            throw new BadRequestException("修改失败，旧密码错误");
        }
        if(passwordEncoder.matches(newPass, user.getPassword())){
            throw new BadRequestException("新密码不能与旧密码相同");
        }
        userService.updatePass(user.getUsername(),passwordEncoder.encode(newPass));
        return new ResponseEntity<>(HttpStatus.OK);
    }

    @ApiOperation("重置密码")
    @PutMapping(value = "/resetPwd")
    public ResponseEntity<Object> resetPwd(@RequestBody Set<Long> ids) {
        String pwd = passwordEncoder.encode("123456");
        userService.resetPwd(ids, pwd);
        return new ResponseEntity<>(HttpStatus.OK);
    }

    @ApiOperation("修改头像")
    @PostMapping(value = "/updateAvatar")

View on GitHub (pinned to 55fbf70595)

Solutions

Have the user retype the old password carefully — the simple and most common cause.
If EVERY attempt fails, verify the RSA keypair: the front-end jsencrypt public key must match eladmin's RsaProperties (config/RsaProperties, default eladmin key). Re-sync and hard-refresh the front end.
Confirm the client encrypts oldPass/newPass with the public key before sending — the controller decrypts unconditionally.
As admin, reset the user's password via PUT /api/users/resetPwd if the user is locked out.

Defensive patterns

Strategy: validation

Validate before calling

// Basic client check before calling updatePass
if (!oldPass || !newPass) { notifyError('请填写完整'); return; }
if (oldPass === newPass) { notifyError('新密码不能与旧密码相同'); return; }
await axios.post('/api/users/updatePass', {
  oldPass: encrypt(oldPass), // RSA public key, same as backend keypair
  newPass: encrypt(newPass),
});

Try / catch

Catch 400 from /updatePass and map message to the form field (old-password error near the old input); never auto-retry.

Prevention

Keep the front-end RSA public key in sync with RsaProperties on the server.
Validate non-empty old/new client-side before the round trip.
Admins: use /resetPwd as the recovery path for locked-out users.

When it happens

Trigger: User typos the old password; server's RsaProperties.privateKey regenerated/redeployed so the front-end-encrypted oldPass decrypts to garbage; user already changed the password in another tab/session and repeats the outdated old password; client posting plaintext while keys expect RSA-encrypted payloads (or vice versa after a key rotation).

Common situations: Front-end and back-end RSA public/private key mismatch after re-generating keys or copying config between environments; password changed elsewhere with stale form state; old browsers caching the old public key.

Related errors

AI-assisted analysis of elunez/eladmin@55fbf70595 (2026-08-14). Data as JSON: /api/errors/21c25cb254b0bcad. Report an issue: GitHub.