Apache StreamPark (incubating): Logic error causing any account reset

@@ -137,11 +137,9 @@ public RestResponse checkPassword(
     }
 
     @PutMapping("password")
-    public RestResponse updatePassword(
-        @NotBlank(message = "{required}") String username,
-        @NotBlank(message = "{required}") String password)
+    public RestResponse updatePassword(User user)
         throws Exception {
-        userService.updatePassword(username, password);
+        userService.updatePassword(user);
         return RestResponse.success();
     }
 

@@ -85,6 +85,8 @@ public class User implements Serializable {
 
     private String avatar;
 
+    private transient String oldPassword;
+
     private transient String sortField;
 
     private transient String sortOrder;

@@ -35,6 +35,7 @@
 import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl;
 import lombok.extern.slf4j.Slf4j;
 import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.lang3.StringUtils;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Propagation;
@@ -137,14 +138,23 @@ public void updateAvatar(String username, String avatar) {
 
     @Override
     @Transactional(rollbackFor = Exception.class)
-    public void updatePassword(String username, String password) {
-        User user = new User();
+    public void updatePassword(User userParam) {
+        User user = getById(userParam.getUserId());
+        if (user == null) {
+            throw new ApiAlertException("update password failed, user is null");
+        }
+
+        String saltPassword = ShaHashUtils.encrypt(user.getSalt(), userParam.getOldPassword());
+        if (!StringUtils.equals(user.getPassword(), saltPassword)) {
+            throw new ApiAlertException("update password failed, old password error");
+        }
+
         String salt = ShaHashUtils.getRandomSalt();
-        password = ShaHashUtils.encrypt(salt, password);
+        String password = ShaHashUtils.encrypt(salt, userParam.getPassword());
         user.setSalt(salt);
         user.setPassword(password);
         LambdaQueryWrapper<User> queryWrapper = new LambdaQueryWrapper<User>()
-            .eq(User::getUsername, username);
+            .eq(User::getUserId, user.getUserId());
         this.baseMapper.update(user, queryWrapper);
     }
 

@@ -94,11 +94,10 @@ public interface UserService extends IService<User> {
 
     /**
      * update password
-     *
-     * @param username user
-     * @param password password
+     * @param user
+     * @throws Exception
      */
-    void updatePassword(String username, String password) throws Exception;
+    void updatePassword(User user) throws Exception;
 
     /**
      * reset password

@@ -146,7 +146,8 @@ export function fetchUserTypes() {
  * @param {String} password password
  */
 export function fetchUserPasswordUpdate(data: {
-  username: string;
+  userId: string | number;
+  oldPassword: string;
   password: string;
 }): Promise<boolean> {
   return defHttp.put({

@@ -45,13 +45,23 @@
         component: 'Input',
         render: () => h(Alert, { type: 'info', message: userStore.getUserInfo?.username }),
       },
+      {
+        field: 'oldPassword',
+        label: t('sys.login.oldPassword'),
+        component: 'InputPassword',
+        itemProps: { hasFeedback: true },
+        rules: [
+          { required: true, message: t('sys.login.oldPasswordPlaceholder'), trigger: 'blur' },
+          { min: 8, message: t('system.user.form.passwordHelp'), trigger: 'blur' },
+        ],
+      },
       {
         field: 'password',
-        label: t('sys.login.password'),
+        label: t('sys.login.newPassword'),
         component: 'InputPassword',
         itemProps: { hasFeedback: true },
         rules: [
-          { required: true, message: t('sys.login.passwordPlaceholder'), trigger: 'blur' },
+          { required: true, message: t('sys.login.newPasswordPlaceholder'), trigger: 'blur' },
           { min: 8, message: t('system.user.form.passwordHelp'), trigger: 'blur' },
         ],
       },
@@ -84,15 +94,16 @@
       changeOkLoading(true);
       const formValue = await validate();
       await fetchUserPasswordUpdate({
-        username: userStore.getUserInfo?.username,
+        userId: userStore.getUserInfo?.userId,
+        oldPassword: formValue.oldPassword,
         password: formValue.password,
       });
 
       createConfirm({
         iconType: 'success',
         title: t('sys.modifyPassword.title'),
         content: t('sys.modifyPassword.success'),
-        okText: t('sys.logoutNow'),
+        okText: t('sys.modifyPassword.logout'),
         okType: 'danger',
         onOk: () => {
           userStore.logout(true);

@@ -115,15 +115,18 @@ export default {
     // placeholder
     accountPlaceholder: 'Please input username',
     passwordPlaceholder: 'Please input password',
+    oldPasswordPlaceholder: 'Please input old password',
+    newPasswordPlaceholder: 'Please input new password',
     confirmPasswordPlaceholder: 'Please input confirm password',
     smsPlaceholder: 'Please input sms code',
     mobilePlaceholder: 'Please input mobile',
     policyPlaceholder: 'Register after checking',
     diffPwd: 'The two passwords are inconsistent',
-
     userName: 'Username',
     password: 'Password',
-    confirmPassword: 'Confirm Password',
+    oldPassword: 'Old password',
+    newPassword: 'New password',
+    confirmPassword: 'Confirm password',
     email: 'Email',
     smsCode: 'SMS code',
     mobile: 'Mobile',

@@ -108,6 +108,8 @@ export default {
     // placeholder
     accountPlaceholder: '请输入账号',
     passwordPlaceholder: '请输入密码',
+    oldPasswordPlaceholder: '请输入当前密码',
+    newPasswordPlaceholder: '请输入新密码',
     confirmPasswordPlaceholder: '请输入确认密码',
     smsPlaceholder: '请输入验证码',
     mobilePlaceholder: '请输入手机号码',
@@ -116,6 +118,8 @@ export default {
 
     userName: '账号',
     password: '密码',
+    oldPassword: '当前密码',
+    newPassword: '新密码',
     confirmPassword: '确认密码',
     email: '邮箱',
     smsCode: '短信验证码',