From 5ebded322fdf7f496b93acbbcdd121d16e3d8ad5 Mon Sep 17 00:00:00 2001
From: TermiNexus <wyt18222152539wyt@163.com>
Date: Thu, 18 Jun 2026 18:33:40 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E4=BA=86=20User=20Password?=
 =?UTF-8?q?=20=E9=AA=8C=E6=9D=83?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 backend/view.py |  3 ++-
 users/views.py  | 17 ++++++++++++-----
 2 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/backend/view.py b/backend/view.py
index f72a58a..f7d61fd 100644
--- a/backend/view.py
+++ b/backend/view.py
@@ -598,8 +598,9 @@ class AddAdminUserView(APIView):
                 UserName=openid,
                 OpenID=openid,
                 Phone=phone,
-                UserPassword=password,
             )
+            user_main.SetPassword(password)
+            user_main.save(update_fields=['UserPassword'])
             # 创建客服扩展表（后台用户扩展）
             UserKefu.query.create(
                 user=user_main,
diff --git a/users/views.py b/users/views.py
index a1e7471..ab198d9 100644
--- a/users/views.py
+++ b/users/views.py
@@ -2312,10 +2312,9 @@ class AdminLoginView(APIView):
             # 3. 使用事务确保数据一致性
             with transaction.atomic():
                 # 【优化点1】使用select_related一次性获取管理员扩展表
-                # 只查询管理员类型的用户
+                # 只查询管理员类型的用户（密码用 CheckPassword 验证，不能在 ORM 中直接匹配哈希）
                 user = User.query.filter(
                     Phone=zhanghao,  # 手机号作为账号
-                    UserPassword=mima,  # 密码
                     admin_profile__isnull=False  # 必须是管理员类型
                 ).select_related('admin_profile').first()
 
@@ -2326,6 +2325,13 @@ class AdminLoginView(APIView):
                         status=status.HTTP_401_UNAUTHORIZED
                     )
 
+                # 验证密码（bcrypt 哈希验证）
+                if not user.CheckPassword(mima):
+                    return Response(
+                        {'code': 401, 'msg': '登录失败', 'data': None},
+                        status=status.HTTP_401_UNAUTHORIZED
+                    )
+
                 # 【优化点2】检查管理员扩展表是否存在
                 if not hasattr(user, 'admin_profile'):
                     return Response(
@@ -6747,8 +6753,8 @@ class KefuLoginView(APIView):
 
         for user in user_mains:
             kefu = user.kefu_profile
-            # 验证主密码（明文比较，按您的要求）
-            if user.UserPassword != password:
+            # 验证主密码（bcrypt 哈希验证）
+            if not user.CheckPassword(password):
                 continue
 
             # 验证二级密码（明文比较）
@@ -10342,9 +10348,10 @@ class AdKftjView(APIView):
                 UserUID=generate_yonghuid(),
                 UserName=f'kefu_{phone}',
                 Phone=phone,
-                UserPassword=password,
                 OpenID=f'kefu_{phone}'  # 临时openid
             )
+            user.SetPassword(password)
+            user.save(update_fields=['UserPassword'])
             # 创建客服扩展表
             kefu = UserKefu.query.create(
                 user=user,