elunez/eladmin · error · BadRequestException

不能修改他人资料

Error message

不能修改他人资料

What it means

Thrown by UserController.centerUser (line 133) on PUT /api/users/center when the id in the body does not equal SecurityUtils.getCurrentUserId(). The personal-center endpoint is intentionally self-service only: even holders of user:edit cannot use it to modify another account. The comparison is done on the JWT-derived id, so the body id must match the token's subject exactly.

Source

Thrown at eladmin-system/src/main/java/me/zhengjie/modules/system/rest/UserController.java:133

        return new ResponseEntity<>(HttpStatus.CREATED);
    }

    @Log("修改用户")
    @ApiOperation("修改用户")
    @PutMapping
    @PreAuthorize("@el.check('user:edit')")
    public ResponseEntity<Object> updateUser(@Validated(User.Update.class) @RequestBody User resources) throws Exception {
        checkLevel(resources);
        userService.update(resources);
        return new ResponseEntity<>(HttpStatus.NO_CONTENT);
    }

    @Log("修改用户：个人中心")
    @ApiOperation("修改用户：个人中心")
    @PutMapping(value = "center")
    public ResponseEntity<Object> centerUser(@Validated(User.Update.class) @RequestBody User resources){
        if(!resources.getId().equals(SecurityUtils.getCurrentUserId())){
            throw new BadRequestException("不能修改他人资料");
        }
        userService.updateCenter(resources);
        return new ResponseEntity<>(HttpStatus.NO_CONTENT);
    }

    @Log("删除用户")
    @ApiOperation("删除用户")
    @DeleteMapping
    @PreAuthorize("@el.check('user:del')")
    public ResponseEntity<Object> deleteUser(@RequestBody Set<Long> ids){
        for (Long id : ids) {
            Integer currentLevel =  Collections.min(roleService.findByUsersId(SecurityUtils.getCurrentUserId()).stream().map(RoleSmallDto::getLevel).collect(Collectors.toList()));
            Integer optLevel =  Collections.min(roleService.findByUsersId(id).stream().map(RoleSmallDto::getLevel).collect(Collectors.toList()));
            if (currentLevel > optLevel) {
                throw new BadRequestException("角色权限不足，不能删除：" + userService.findById(id).getUsername());
            }
        }
        userService.delete(ids);

View on GitHub (pinned to 55fbf70595)

Solutions

1. Always send the current token's user id: fetch the profile from GET /api/users/info and post back its id unchanged.
2. After login/logout, clear cached profile state (Vuex/localStorage) so the center form cannot hold a previous account's id.
3. To administer another user, use PUT /api/users (updateUser) with user:edit permission instead of /center.

Example fix

// before
axios.put('/api/users/center', this.storedProfile) // id from stale storage
// after
const { data: me } = await axios.get('/api/users/info');
axios.put('/api/users/center', { ...this.form, id: me.user.id })

const me = store.state.user.user; // source of truth = token subject
if (form.id !== me.id) form.id = me.id; // hard-sync before submit
await axios.put('/api/users/center', form);

const isSelfEdit = (formId, currentUserId) => formId === currentUserId;

When it happens

Trigger: Front-end personal-center page posting a stale user object after the account re-logged-in as someone else; token refreshed but the locally cached user id not; a crafted request trying to edit another user's nickname/phone via the center endpoint (correctly blocked).

Common situations: Local storage holding an old user object after switching accounts in the same browser; front-end caching the profile separately from the token; testers probing the endpoint with arbitrary ids.

Related errors

• 角色权限不足，不能删除：{username}
• 角色权限不足
• 权限不足，你的角色级别：{min}，低于操作的角色级别：{level}
• 修改失败，旧密码错误
• 新密码不能与旧密码相同

AI-assisted analysis of elunez/eladmin@55fbf70595 (2026-08-14). Data as JSON: /api/errors/48134e8ee7abafab. Report an issue: GitHub.