修复了 UserPassword 不存在的问题，修复了明文密码的问题

users/views.py

@@ -6757,8 +6757,13 @@ class KefuLoginView(APIView):
             if not user.CheckPassword(password):
                 continue
 
-            # 验证二级密码（明文比较）
-            if kefu.erjimima != erjimima:
+            # 验证二级密码（兼容 bcrypt 哈希和明文）
+            stored_erji = kefu.erjimima or ''
+            if stored_erji.startswith(('$2b$', '$2a$')) and len(stored_erji) == 60:
+                import bcrypt as _bcrypt
+                if not _bcrypt.checkpw(erjimima.encode('utf-8'), stored_erji.encode('utf-8')):
+                    continue
+            elif stored_erji != erjimima:
                 continue
 
             # 如果账号被禁用，记录但继续查找（可能还有其他正常账号？）
@@ -10353,10 +10358,12 @@ class AdKftjView(APIView):
             user.SetPassword(password)
             user.save(update_fields=['UserPassword'])
             # 创建客服扩展表
+            import bcrypt as _bcrypt
+            erjimima_hashed = _bcrypt.hashpw(erjimima.encode('utf-8'), _bcrypt.gensalt(rounds=12)).decode('utf-8')
             kefu = UserKefu.query.create(
                 user=user,
                 nicheng=nicheng or f'客服{user.yonghuid}',
-                erjimima=erjimima,  # 建议实际项目中加密存储
+                erjimima=erjimima_hashed,
                 zhuangtai=1,
                 jinrichuli=0,
                 jinyuechuli=0,
@@ -10498,7 +10505,9 @@ class AdKfxgView(APIView):
             if 'nicheng' in request.data:
                 kefu.nicheng = request.data['nicheng']
             if 'erjimima' in request.data:
-                kefu.erjimima = request.data['erjimima']
+                import bcrypt as _bcrypt
+                new_erji = request.data['erjimima']
+                kefu.erjimima = _bcrypt.hashpw(new_erji.encode('utf-8'), _bcrypt.gensalt(rounds=12)).decode('utf-8')
             if 'zhuangtai' in request.data:
                 kefu.zhuangtai = int(request.data['zhuangtai'])
             kefu.save()