修改密码时验证旧密码是否一致

src/main/java/com/ydtech/modules/admin/controller/SysUserController.java

@@ -1,6 +1,7 @@
 package com.ydtech.modules.admin.controller;
 
 
+import cn.dev33.satoken.stp.StpUtil;
 import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
 import com.baomidou.mybatisplus.core.conditions.update.LambdaUpdateWrapper;
 import com.baomidou.mybatisplus.core.metadata.IPage;
@@ -233,7 +234,7 @@ public class SysUserController extends BaseController {
      * @return
      */
     @PostMapping(value = "/updatePwd")
-    public HttpResult updatePwd(@RequestParam String id, @RequestParam String password) {
+    public HttpResult updatePwd(@RequestParam String id, @RequestParam String password, @RequestParam String oldPassword) {
         if (StringUtils.isEmpty(id) || StringUtils.isEmpty(password)) {
             return HttpResult.error("ID和密码不能为空");
         }
@@ -241,11 +242,18 @@ public class SysUserController extends BaseController {
         if (sysUser == null) {
             return HttpResult.error("ID不存在");
         }
+        if (password.equals(oldPassword)) {
+            return HttpResult.error("新密码不能与旧密码相同");
+        }
+        if (!PasswordUtils.matches(sysUser.getSalt(), oldPassword, sysUser.getPassword())) {
+            return HttpResult.error("旧密码输入不正确");
+        }
         //密码加密
         String pwd = PasswordUtils.encode(password, sysUser.getSalt());
         sysUser.setPassword(pwd);
         sysUserService.updateById(sysUser);
-        return HttpResult.ok("修改成功");
+        StpUtil.logout();
+        return HttpResult.ok("修改成功,请重新登录");
     }
 
     /**