jeecgboot/JeecgBoot · error · JeecgBootException

您输入的密码不正确，无法删除该用户！

Error message

您输入的密码不正确，无法删除该用户！

What it means

Thrown by SysTenantServiceImpl.verifyCreateTimeAndPassword when deleting a tenant user. After confirming the target user was created today, the method re-authenticates the *current logged-in* user (the admin/tenant creator) by re-encrypting the submitted password with that admin's salt and comparing it to the stored hash. A mismatch raises this exception.

Source

Thrown at jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/service/impl/SysTenantServiceImpl.java:952

     */
    private void verifyCreateTimeAndPassword(SysUser sysUser,String password) {
        if(null == sysUser){
            throw new JeecgBootException("该用户不存在，无法删除！");
        }
        //step1 验证创建时间
        //当前登录用户
        LoginUser user = (LoginUser) SecurityUtils.getSubject().getPrincipal();
        Date createTime = sysUser.getCreateTime();
        boolean sameDay = DateUtils.isSameDay(createTime, new Date());
        if(!sameDay){
            throw new JeecgBootException("用户不是今天创建的，无法删除！");
        }
        //step2 验证密码
        //获取admin的用户
        SysUser adminUser = userService.getById(user.getId());
        String passwordEncode = PasswordUtil.encrypt(adminUser.getUsername(), password, adminUser.getSalt());
        if(!passwordEncode.equals(adminUser.getPassword())){
            throw new JeecgBootException("您输入的密码不正确，无法删除该用户！");
        }
    }

    @Override
    public List<SysTenant> getTenantListByUserId(String userId) {
        return tenantMapper.getTenantListByUserId(userId);
    }

    @Override
    public void deleteUser(SysUser sysUser, Integer tenantId) {
        //被删除人的用户id
        String userId = sysUser.getId();
        //被删除人的密码
        String password = sysUser.getPassword();
        //当前登录用户
        LoginUser user = (LoginUser) SecurityUtils.getSubject().getPrincipal();
        //step1 判断当前用户是否为当前租户的创建者才可以删除
        SysTenant sysTenant = this.getById(tenantId);

View on GitHub (pinned to 96fb33f5ec)

Solutions

1. Confirm the password submitted is the password of the currently-authenticated user (LoginUser from SecurityUtils), not the target user being deleted.
2. Check that the admin user row has a consistent username+salt+password triple in sys_user table.
3. If PasswordUtil was upgraded, re-hash admin passwords or align the encrypt parameters (username, password, salt).
4. Verify the frontend delete-user form actually binds the logged-in admin's password into the request payload.

Example fix

// before: payload carries target user's password
deleteUser(sysUser)  // sysUser.password = target user password

// after: ensure the request carries the current admin's password
// frontend form field = '当前登录用户密码', bound to sysUser.password
deleteUser(sysUser)  // sysUser.password = current admin password

// Before calling deleteUser, verify the admin's password client-side is the current user's
LoginUser me = (LoginUser) SecurityUtils.getSubject().getPrincipal();
SysUser admin = userService.getById(me.getId());
String enc = PasswordUtil.encrypt(admin.getUsername(), password, admin.getSalt());
if (!enc.equals(admin.getPassword())) {
    return Result.error("请输入当前登录用户的正确密码");
}

// ensure the SysUser passed to deleteUser carries a non-blank password
boolean hasPwd = sysUser != null && sysUser.getPassword() != null && !sysUser.getPassword().isBlank();

try { sysTenantService.deleteUser(sysUser, tenantId); }
catch (JeecgBootException e) {
  if (e.getMessage().contains("密码不正确")) return Result.error("密码校验失败，请重新输入");
  throw e;
}

When it happens

Trigger: Calling the tenant-user-delete flow with a password parameter that does not match the current login user's (admin's) actual password. The password is taken from the SysUser object passed into deleteUser and forwarded to verifyCreateTimeAndPassword.

Common situations: The frontend sends the wrong user's password, the admin changed their password recently and the cached form value is stale, the salt in the DB is out of sync with the stored hash, or PasswordUtil.encrypt logic changed between versions so re-encryption no longer matches.

Related errors

• 您不是当前组织的创建者，无法删除用户！
• 该用户还存在于其它组织中，无法删除用户！
• 离职失败，该用户已不存在
• 离职失败，租户不存在
• token不能为空!

AI-assisted analysis of jeecgboot/JeecgBoot@96fb33f5ec (2026-08-14). Data as JSON: /api/errors/474bbf512c8ccc88. Report an issue: GitHub.