vaxilu/x-ui · warning

原用户名或原密码错误

Error message

原用户名或原密码错误

What it means

This error is thrown by updateUser in web/controller/setting.go when the currently logged-in user's stored username or password does not match the OldUsername/OldPassword values submitted in the form. It is a deliberate re-authentication check: the app requires the user to confirm their existing credentials before allowing a username/password change. The comparison is done on plain string equality (user.Password != form.OldPassword), so any mismatch produces this error and the update is aborted.

Source

Thrown at web/controller/setting.go:69

	err := c.ShouldBind(allSetting)
	if err != nil {
		jsonMsg(c, "修改设置", err)
		return
	}
	err = a.settingService.UpdateAllSetting(allSetting)
	jsonMsg(c, "修改设置", err)
}

func (a *SettingController) updateUser(c *gin.Context) {
	form := &updateUserForm{}
	err := c.ShouldBind(form)
	if err != nil {
		jsonMsg(c, "修改用户", err)
		return
	}
	user := session.GetLoginUser(c)
	if user.Username != form.OldUsername || user.Password != form.OldPassword {
		jsonMsg(c, "修改用户", errors.New("原用户名或原密码错误"))
		return
	}
	if form.NewUsername == "" || form.NewPassword == "" {
		jsonMsg(c, "修改用户", errors.New("新用户名和新密码不能为空"))
		return
	}
	err = a.userService.UpdateUser(user.Id, form.NewUsername, form.NewPassword)
	if err == nil {
		user.Username = form.NewUsername
		user.Password = form.NewPassword
		session.SetLoginUser(c, user)
	}
	jsonMsg(c, "修改用户", err)
}

func (a *SettingController) restartPanel(c *gin.Context) {
	err := a.panelService.RestartPanel(time.Second * 3)
	jsonMsg(c, "重启面板", err)

View on GitHub (pinned to 9c1be8c57a)

Solutions

1. Enter the exact current username and password of the logged-in account in the OldUsername/OldPassword fields
2. Re-login to refresh the session user object, then retry the change
3. If the old password is forgotten, reset it via the password-reset/admin flow instead of this form
4. Trim input and disable browser autofill for the old-password field to avoid stale autofilled values

Example fix

// before
if user.Username != form.OldUsername || user.Password != form.OldPassword {
    jsonMsg(c, "修改用户", errors.New("原用户名或原密码错误"))
    return
}
// after
form.OldUsername = strings.TrimSpace(form.OldUsername)
form.OldPassword = strings.TrimSpace(form.OldPassword)
if user.Username != form.OldUsername || user.Password != form.OldPassword {
    jsonMsg(c, "修改用户", errors.New("原用户名或原密码错误"))
    return
}

if user.Username != form.OldUsername || user.Password != form.OldPassword {
    // abort: do not call UpdateUser
    jsonMsg(c, "修改用户", errors.New("原用户名或原密码错误"))
    return
}

if err := updateUserFlow(c, form); err != nil {
    if err.Error() == "原用户名或原密码错误" {
        c.JSON(401, gin.H{"msg": "old credentials do not match"})
        return
    }
    c.JSON(500, gin.H{"msg": err.Error()})
}

When it happens

Trigger: POSTing the update-user settings form with an OldUsername that differs from session user's username, or an OldPassword string that is not exactly equal to the stored user.Password (including whitespace or casing differences). Also occurs if the session user object is stale relative to recent credential changes.

Common situations: A user typoing their old password when changing credentials; a user whose password was changed in another session/tab leaving the form pre-filled with the old value; administrators copying the wrong account's credentials; typing the new password into the old-password field.

Related errors

• 新用户名和新密码不能为空
• username can not be empty
• password can not be empty

AI-assisted analysis of vaxilu/x-ui@9c1be8c57a (2026-09-02). Data as JSON: /api/errors/d08141c6c8579aa2. Report an issue: GitHub.