修复了 UserPassword 不存在的问题，修复了明文密码的问题

gvsdsdk/management/commands/hash_passwords.py

@@ -0,0 +1,28 @@
+"""将 User 表中明文密码迁移为 bcrypt 哈希"""
+from django.core.management.base import BaseCommand
+from gvsdsdk.models import User
+
+
+class Command(BaseCommand):
+    help = '将 User 表中所有明文密码迁移为 bcrypt 哈希'
+
+    def handle(self, *args, **options):
+        # 筛选非空且非 bcrypt 哈希的密码
+        users = User.objects.exclude(UserPassword='')
+        updated = 0
+        skipped = 0
+
+        for user in users.iterator():
+            stored = user.UserPassword or ''
+            # 已是 bcrypt 哈希则跳过
+            if stored.startswith(('$2b$', '$2a$')) and len(stored) == 60:
+                skipped += 1
+                continue
+            # 明文密码 → bcrypt 哈希
+            user.SetPassword(stored)
+            user.save(update_fields=['UserPassword'])
+            updated += 1
+
+        self.stdout.write(self.style.SUCCESS(
+            f'完成：{updated} 条明文密码已转为 bcrypt，{skipped} 条已是哈希跳过'
+        ))

gvsdsdk/models.py

@@ -256,15 +256,21 @@ class User(QModel):
         self.UserPassword = hashed.decode('utf-8')
 
     def CheckPassword(self, RawPassword):
-        """验证密码"""
+        """验证密码——兼容 bcrypt 哈希和明文存储"""
         import bcrypt
-        try:
-            return bcrypt.checkpw(
-                RawPassword.encode('utf-8'),
-                self.UserPassword.encode('utf-8')
-            )
-        except Exception:
-            return False
+        stored = self.UserPassword or ''
+        # bcrypt 哈希以 $2b$ 或 $2a$ 开头，长度固定 60
+        if stored.startswith(('$2b$', '$2a$')) and len(stored) == 60:
+            try:
+                return bcrypt.checkpw(
+                    RawPassword.encode('utf-8'),
+                    stored.encode('utf-8')
+                )
+            except Exception:
+                return False
+        else:
+            # 明文密码（旧数据兼容）
+            return stored == RawPassword
 
     def GetTele(self):
         """获取电话，空则返回默认文本"""