From 9a60bd74ebf3d20556f279b49d982825fdc1af18 Mon Sep 17 00:00:00 2001 From: smail Date: Fri, 25 Sep 2026 23:07:54 +0800 Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E4=BA=8B=E5=8A=A1=E6=8B=92?= =?UTF-8?q?=E7=BB=9D=E5=93=8D=E5=BA=94=E4=B8=8E=E5=8D=95=E5=BA=93=E4=BC=9A?= =?UTF-8?q?=E8=AF=9D=E7=BB=AD=E6=9C=9F=E4=BA=92=E7=9B=B8=E7=AD=89=E5=BE=85?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- backend/controllers/settings.go | 4 ++++ backend/controllers/user.go | 7 +++++++ 2 files changed, 11 insertions(+) diff --git a/backend/controllers/settings.go b/backend/controllers/settings.go index 77f7f9d..5c0283b 100644 --- a/backend/controllers/settings.go +++ b/backend/controllers/settings.go @@ -130,20 +130,24 @@ func ModifyPassword(ctx *context.Context, w http.ResponseWriter, req *http.Reque affected, err := tx.Where("id = ? and password = ? and session_version = ? and security_version = ? and disabled = 0", ctx.UserID, currentUser.Password, currentUser.SessionVersion, currentUser.SecurityVersion).Cols("password", "session_version", "security_version", "must_change_password", "password_changed_at").Update(&user) if err != nil { log.WithContext(ctx).WithError(err).Error("update password failed") + _ = tx.Rollback() response.NewErrorResponse(response.ServerError, i18n.GetText(ctx.Lang, "unknowError"), "").FPrint(w) return } if affected != 1 { + _ = tx.Rollback() log.WithContext(ctx).Warn("password changed concurrently") response.NewErrorResponse(response.ParamsError, i18n.GetText(ctx.Lang, "unknowError"), "").FPrint(w) return } if err := credentialService.RevokeAllWithSession(tx, ctx.UserID); err != nil { + _ = tx.Rollback() log.WithContext(ctx).WithError(err).Error("revoke credentials after password change failed") response.NewErrorResponse(response.ServerError, i18n.GetText(ctx.Lang, "unknowError"), "").FPrint(w) return } if err := tx.Commit(); err != nil { + _ = tx.Rollback() log.WithContext(ctx).WithError(err).Error("commit password change failed") response.NewErrorResponse(response.ServerError, i18n.GetText(ctx.Lang, "unknowError"), "").FPrint(w) return diff --git a/backend/controllers/user.go b/backend/controllers/user.go index ef32b4a..5c60fc1 100644 --- a/backend/controllers/user.go +++ b/backend/controllers/user.go @@ -423,6 +423,7 @@ func EditUser(ctx *context.Context, w http.ResponseWriter, req *http.Request) { }() updateColumns := []string{"name", "disabled", "role", "is_admin"} if err := accountgroup.CheckWrite(tx, writeGuard); err != nil { + _ = tx.Rollback() writeAccountGroupError(w, err) return } @@ -435,15 +436,18 @@ func EditUser(ctx *context.Context, w http.ResponseWriter, req *http.Request) { update := tx.ID(user.ID).Where("session_version = ? AND security_version = ?", originalSessionVersion, originalSecurityVersion).Cols(updateColumns...) accountgroup.ApplyScope(update, ctx.UserID, ctx.EffectiveRole()) if num, err := update.Update(&user); err != nil { + _ = tx.Rollback() log.WithContext(ctx).WithError(err).Error("update user failed") response.NewErrorResponse(response.ServerError, "更新用户失败", "").FPrint(w) return } else if num == 0 { + _ = tx.Rollback() response.NewErrorResponse(response.ServerError, "没有可更新的数据", "").FPrint(w) return } if reqData.Password != "" { if err := credentialService.RevokeAllWithSession(tx, user.ID); err != nil { + _ = tx.Rollback() log.WithContext(ctx).WithError(err).Error("revoke target credentials failed") response.NewErrorResponse(response.ServerError, "撤销目标用户安全凭据失败", "").FPrint(w) return @@ -452,15 +456,18 @@ func EditUser(ctx *context.Context, w http.ResponseWriter, req *http.Request) { if user.EffectiveRole() != access.RoleAdmin { count, err := tx.Where("user_id = ?", user.ID).Count(&models.AccountGroupMember{}) if err != nil { + _ = tx.Rollback() writeAccountGroupError(w, err) return } if count > 1 { + _ = tx.Rollback() writeSecurityError(w, response.ParamsError, "请先将账号调整为一个分组，再更改为普通用户") return } } if err := tx.Commit(); err != nil { + _ = tx.Rollback() log.WithContext(ctx).WithError(err).Error("commit user update failed") response.NewErrorResponse(response.ServerError, "更新用户失败", "").FPrint(w) return