What causes "新用户名和新密码不能为空" in vaxilu/x-ui?

Fill in both the new username and new password before submitting

新用户名和新密码不能为空

Error message

新用户名和新密码不能为空

What it means

Thrown by updateUser when the submitted form passes the old-credential check but NewUsername or NewPassword is an empty string. The service refuses to write blank credentials because UpdateUser would otherwise overwrite a valid account with empty values, which could lock the user out. It is a guard against destructive empty-string updates.

Source

Thrown at web/controller/setting.go:73

	}
	err = a.settingService.UpdateAllSetting(allSetting)
	jsonMsg(c, "修改设置", err)
}

func (a *SettingController) updateUser(c *gin.Context) {
	form := &updateUserForm{}
	err := c.ShouldBind(form)
	if err != nil {
		jsonMsg(c, "修改用户", err)
		return
	}
	user := session.GetLoginUser(c)
	if user.Username != form.OldUsername || user.Password != form.OldPassword {
		jsonMsg(c, "修改用户", errors.New("原用户名或原密码错误"))
		return
	}
	if form.NewUsername == "" || form.NewPassword == "" {
		jsonMsg(c, "修改用户", errors.New("新用户名和新密码不能为空"))
		return
	}
	err = a.userService.UpdateUser(user.Id, form.NewUsername, form.NewPassword)
	if err == nil {
		user.Username = form.NewUsername
		user.Password = form.NewPassword
		session.SetLoginUser(c, user)
	}
	jsonMsg(c, "修改用户", err)
}

func (a *SettingController) restartPanel(c *gin.Context) {
	err := a.panelService.RestartPanel(time.Second * 3)
	jsonMsg(c, "重启面板", err)
}

View on GitHub (pinned to 9c1be8c57a)

Solutions

Fill in both the new username and new password before submitting
Add client-side required-field validation so empty submissions never reach the server
If calling the API directly, include non-empty newUsername and newPassword in the request body

Example fix

// before (client sends partial payload)
fetch('/setting/updateUser', {method:'POST', body: {oldUsername, oldPassword}})
// after
if (!newUsername || !newPassword) { alert('新用户名和新密码不能为空'); return; }
fetch('/setting/updateUser', {method:'POST', body: {oldUsername, oldPassword, newUsername, newPassword}})

Defensive patterns

Strategy: validation

Validate before calling

if form.NewUsername == "" || form.NewPassword == "" {
    return errors.New("新用户名和新密码不能为空")
}

Try / catch

if err := updateUserFlow(c, form); err != nil {
    if err.Error() == "新用户名和新密码不能为空" {
        c.JSON(400, gin.H{"msg": "new username and password are required"})
        return
    }
    c.JSON(500, gin.H{"msg": err.Error()})
}

Prevention

Mark new username/password as required in the frontend form
Use struct binding tags like binding:"required" server-side
Never submit the form until all fields pass client validation
For API callers, validate payload completeness before sending

When it happens

Trigger: Submitting the update-user form with only OldUsername/OldPassword filled and one or both of NewUsername/NewPassword left blank; a client sending a JSON/form body omitting the new credential fields (Go decodes missing fields as "").

Common situations: Users clicking save after clearing the new-password field; API/scripts calling the endpoint with partial payloads; frontend form validation not enforcing required fields before submission.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

AI-assisted analysis of vaxilu/x-ui@9c1be8c57a (2026-09-02). Data as JSON: /api/errors/132671b4f399c0b8. Report an issue: GitHub.