jeecgboot/JeecgBoot · error · JeecgBootException
您不是该用户的创建人，无法删除！
Error message
您不是该用户的创建人，无法删除！
What it means
deleteUserByPassword throws (step3) when sysUserData.createBy does not equal the current operator's username — only the user who created the target account may delete it. This restricts deletion to the original creator as an accountability measure.
Source
Thrown at jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/service/impl/SysTenantServiceImpl.java:917
LoginUser user = (LoginUser) SecurityUtils.getSubject().getPrincipal();
//step1 判断当前用户是否为当前租户的管理员(只有超级管理员和账号管理员可以删除)
Long isHaveAdmin = sysTenantPackUserMapper.izHaveBuyAuth(user.getId(), tenantId);
if(null == isHaveAdmin || 0 == isHaveAdmin){
throw new JeecgBootException("您不是当前组织的管理员，无法删除用户！");
}
//step2 离职状态下，并且无其他组织情况下，可以删除
SysUserTenant sysUserTenant = userTenantMapper.getUserTenantByTenantId(userId, tenantId);
if(null == sysUserTenant || !CommonConstant.USER_TENANT_QUIT.equals(sysUserTenant.getStatus())){
throw new JeecgBootException("用户没有离职，不允许删除！");
}
List<Integer> tenantIdsByUserId = userTenantMapper.getTenantIdsByUserId(userId);
if(CollectionUtils.isNotEmpty(tenantIdsByUserId) && tenantIdsByUserId.size()>0){
throw new JeecgBootException("用户尚有未退出的组织，无法删除！");
}
//step3 当天创建的用户和创建人可以删除
SysUser sysUserData = userService.getById(userId);
if(!sysUserData.getCreateBy().equals(user.getUsername())){
throw new JeecgBootException("您不是该用户的创建人，无法删除！");
}
// 代码逻辑说明: 【QQYUN-11839】删除用户，需要输入被删除用户的密码，这逻辑对吗？不应该是管理员的密码吗---
this.verifyCreateTimeAndPassword(sysUserData,password);
//step5 逻辑删除用户
userService.deleteUser(userId);
//step6 真实删除用户
userService.removeLogicDeleted(Collections.singletonList(userId));
}
/**
* 验证创建时间和密码
*
* @param sysUser
* @param password
*/
private void verifyCreateTimeAndPassword(SysUser sysUser,String password) {View on GitHub (pinned to 96fb33f5ec)
Solutions
- Have the original creator (sys_user.create_by) perform the deletion, or have them delegate.
- If the creator is unavailable, an admin with DB access can update create_by or remove the row directly (with audit logging).
- Verify exact username match including case when comparing createBy.
- Consider relaxing this rule via configuration if org policy allows broader admin deletion.
Example fix
// before
tenantService.deleteUserByPassword(targetUser, tenantId);
// after
SysUser data = userService.getById(targetUser.getId());
if (!data.getCreateBy().equals(currentUser().getUsername())) {
return Result.error("仅账号创建人（" + data.getCreateBy() + "）可删除该用户");
}
tenantService.deleteUserByPassword(targetUser, tenantId); Defensive patterns
Strategy: try-catch
Validate before calling
SysUser data = userService.getById(userId);
if (data == null || !data.getCreateBy().equals(currentUser().getUsername())) {
return Result.error("仅创建人可删除该用户");
} Try / catch
try {
tenantService.deleteUserByPassword(targetUser, tenantId);
} catch (JeecgBootException e) {
if (e.getMessage().contains("创建人")) {
return Result.error("仅账号创建人可删除，当前创建人：" + data.getCreateBy());
}
throw e;
} Prevention
- Surface the createBy value so the operator knows who can delete.
- Ensure exact (case-sensitive) username match in comparisons.
- Escalate to DB-level handling if the creator is unavailable and policy permits.
When it happens
Trigger: An admin (who has tenant authority and the user is resigned) attempts deletion, but they are not the user recorded in sys_user.create_by. Even a super-admin fails this check if they didn't create the account.
Common situations: Admin inherits a user created by a predecessor; the account was created by an automated/system user; username casing mismatch in the createBy comparison; operator confusion about who created the account.
Related errors
AI-assisted analysis of jeecgboot/JeecgBoot@96fb33f5ec (2026-08-14).
Data as JSON: /api/errors/4563169e93cb6464.
Report an issue: GitHub.