yumoqing/rbac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(reset_password): guard admin against resetting own password (use self-service)

Browse Source
This commit is contained in:
yumoqing 2026-09-09 19:06:55 +08:00
parent c572d4c254
commit a3b22b679f
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
wwwroot/api/admin_reset_password.dspy
View File

@ -17,6 +17,11 @@ target_id = ns.get('userid')
new_password = ns.get('new_password')
cfm_password = ns.get('cfm_password')
# 守卫：管理员不得重置自己的密码（自己改密走 /rbac/user/reset_password 自助入口）
op_id = await get_user()
if op_id and str(op_id) == str(target_id):
return {"widgettype":"Error","options":{"title":"Reset Password Error","cwidth":16,"cheight":9,"timeout":3,"message":"cannot reset your own password, use self-service reset"}}
if not target_id:
return {"widgettype":"Error","options":{"title":"Parameter Error","cwidth":16,"cheight":9,"timeout":3,"message":"missing userid"}}
if not new_password or len(new_password) < 8: