elunez/eladmin · warning · BadRequestException

新密码不能与旧密码相同

Error message

新密码不能与旧密码相同

What it means

Thrown by UserController.updateUserPass (line 165) on POST /api/users/updatePass when the new password (RSA-decrypted) matches the current stored hash. eladmin forbids password reuse on change: after verifying the old password is correct, it rejects a new password identical to the old one. Note the ordering — you only see this error when the old password was already validated.

Source

Thrown at eladmin-system/src/main/java/me/zhengjie/modules/system/rest/UserController.java:165

            if (currentLevel > optLevel) {
                throw new BadRequestException("角色权限不足，不能删除：" + userService.findById(id).getUsername());
            }
        }
        userService.delete(ids);
        return new ResponseEntity<>(HttpStatus.OK);
    }

    @ApiOperation("修改密码")
    @PostMapping(value = "/updatePass")
    public ResponseEntity<Object> updateUserPass(@RequestBody UserPassVo passVo) throws Exception {
        String oldPass = RsaUtils.decryptByPrivateKey(RsaProperties.privateKey,passVo.getOldPass());
        String newPass = RsaUtils.decryptByPrivateKey(RsaProperties.privateKey,passVo.getNewPass());
        UserDto user = userService.findByName(SecurityUtils.getCurrentUsername());
        if(!passwordEncoder.matches(oldPass, user.getPassword())){
            throw new BadRequestException("修改失败，旧密码错误");
        }
        if(passwordEncoder.matches(newPass, user.getPassword())){
            throw new BadRequestException("新密码不能与旧密码相同");
        }
        userService.updatePass(user.getUsername(),passwordEncoder.encode(newPass));
        return new ResponseEntity<>(HttpStatus.OK);
    }

    @ApiOperation("重置密码")
    @PutMapping(value = "/resetPwd")
    public ResponseEntity<Object> resetPwd(@RequestBody Set<Long> ids) {
        String pwd = passwordEncoder.encode("123456");
        userService.resetPwd(ids, pwd);
        return new ResponseEntity<>(HttpStatus.OK);
    }

    @ApiOperation("修改头像")
    @PostMapping(value = "/updateAvatar")
    public ResponseEntity<Object> updateUserAvatar(@RequestParam MultipartFile avatar){
        return new ResponseEntity<>(userService.updateAvatar(avatar), HttpStatus.OK);
    }

View on GitHub (pinned to 55fbf70595)

Solutions

1. Choose a genuinely different new password and resubmit.
2. Clear autofill on the new-password input (autocomplete="new-password") so browsers do not repeat the old one.
3. In automated tests, rotate the password constant each run (e.g. append a counter) instead of reusing it.

if (oldPass === newPass) {
  notifyError('新密码不能与旧密码相同'); // mirrors server rule
  return;
}
await axios.post('/api/users/updatePass', { oldPass: encrypt(oldPass), newPass: encrypt(newPass) });

When it happens

Trigger: User submits the same password for old and new fields; auto-fill fills newPass with the current password; password manager re-suggesting the just-used credential.

Common situations: Password-expiry flows where the user satisfies the prompt with their existing password; browser autofill populating both fields; testing scripts that reuse a constant password across change operations.

Related errors

• 修改失败，旧密码错误
• 文件格式错误！, 仅支持 gif jpg png jpeg 格式
• 文件超出规定大小:{maxSize}MB
• {entity} 不存在: {parameter} is {value}
• 没有这个选项

AI-assisted analysis of elunez/eladmin@55fbf70595 (2026-08-14). Data as JSON: /api/errors/ae7e15cdf2d599ac. Report an issue: GitHub.