elunez/eladmin · error · BadRequestException

密码错误

Error message

密码错误

What it means

Thrown by UserController.updateUserEmail (line 192) on POST /api/users/updateEmail/{code} when the RSA-decrypted password in the body does not match the current user's stored hash. Changing email requires re-authentication: password + an email verification code. Like updatePass, the password travels RSA-encrypted, so a front-end/back-end key mismatch also manifests as this error.

Source

Thrown at eladmin-system/src/main/java/me/zhengjie/modules/system/rest/UserController.java:192

        String pwd = passwordEncoder.encode("123456");
        userService.resetPwd(ids, pwd);
        return new ResponseEntity<>(HttpStatus.OK);
    }

    @ApiOperation("修改头像")
    @PostMapping(value = "/updateAvatar")
    public ResponseEntity<Object> updateUserAvatar(@RequestParam MultipartFile avatar){
        return new ResponseEntity<>(userService.updateAvatar(avatar), HttpStatus.OK);
    }

    @Log("修改邮箱")
    @ApiOperation("修改邮箱")
    @PostMapping(value = "/updateEmail/{code}")
    public ResponseEntity<Object> updateUserEmail(@PathVariable String code,@RequestBody User user) throws Exception {
        String password = RsaUtils.decryptByPrivateKey(RsaProperties.privateKey,user.getPassword());
        UserDto userDto = userService.findByName(SecurityUtils.getCurrentUsername());
        if(!passwordEncoder.matches(password, userDto.getPassword())){
            throw new BadRequestException("密码错误");
        }
        verificationCodeService.validated(CodeEnum.EMAIL_RESET_EMAIL_CODE.getKey() + user.getEmail(), code);
        userService.updateEmail(userDto.getUsername(),user.getEmail());
        return new ResponseEntity<>(HttpStatus.OK);
    }

    /**
     * 如果当前用户的角色级别低于创建用户的角色级别，则抛出权限不足的错误
     * @param resources /
     */
    private void checkLevel(User resources) {
        Integer currentLevel =  Collections.min(roleService.findByUsersId(SecurityUtils.getCurrentUserId()).stream().map(RoleSmallDto::getLevel).collect(Collectors.toList()));
        Integer optLevel = roleService.findByRoles(resources.getRoles());
        if (currentLevel > optLevel) {
            throw new BadRequestException("角色权限不足");
        }
    }
}

View on GitHub (pinned to 55fbf70595)

Solutions

  1. Re-enter the current login password (not the previous one) and retry with a fresh email code.
  2. If it consistently fails, verify the RSA keypair matches between front end (jsencrypt public key) and RsaProperties.privateKey on the server.
  3. Ensure the password input is sent RSA-encrypted by the client exactly like the updatePass flow.
Defensive patterns

Strategy: validation

Validate before calling

if (!password) { notifyError('请输入当前密码'); return; }
await axios.post(`/api/users/updateEmail/${code}`, {
  password: encrypt(password), // RSA, same keypair as updatePass
  email: newEmail,
});

Try / catch

Catch 400 on /updateEmail/{code}; distinguish '密码错误' from code-validation failures and target the correct form field.

Prevention

When it happens

Trigger: User mistypes their password on the change-email dialog; RSA keypair rotated on the server while the browser still encrypts with the old public key; user changed password in another session and enters the outdated one; email change attempted with the password field left as the masked display value.

Common situations: Front-end form sending the display-masked password instead of the typed one; stale cached RSA public key in the SPA; verification-code dialog reused after a password rotation.

Related errors

AI-assisted analysis of elunez/eladmin@55fbf70595 (2026-08-14). Data as JSON: /api/errors/fe44d924e3f84d6e. Report an issue: GitHub.