From 4f9a5af306aa47c022838b25887da7cce241b450 Mon Sep 17 00:00:00 2001 From: OP Date: Sun, 28 Jun 2026 22:35:21 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20=E4=BF=AE=E5=A4=8D=E6=89=BE=E5=9B=9E?= =?UTF-8?q?=E5=AF=86=E7=A0=81=E6=8E=A5=E5=8F=A3=E8=B4=A6=E5=8F=B7=E6=9E=9A?= =?UTF-8?q?=E4=B8=BE=E6=BC=8F=E6=B4=9E?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - verify-reset-code: 将'账号不存在'改为'验证码错误或已过期' - reset-password: 将'账号不存在'改为'验证码错误或已过期' - 防止攻击者通过错误提示枚举有效账号 --- backend/app/api/auth.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/backend/app/api/auth.py b/backend/app/api/auth.py index 5db95f4..8b82b27 100644 --- a/backend/app/api/auth.py +++ b/backend/app/api/auth.py @@ -223,7 +223,7 @@ async def verify_reset_code( ): user = await _find_user_by_account_or_email(db, req.account) if not user: - raise HTTPException(status_code=400, detail="账号不存在") + raise HTTPException(status_code=400, detail="验证码错误或已过期，请重新获取") key = _build_code_key(user.id) result = await db.execute(select(SystemSetting).where(SystemSetting.key == key)) setting = result.scalar_one_or_none() @@ -248,7 +248,7 @@ async def reset_password( ): user = await _find_user_by_account_or_email(db, req.account) if not user: - raise HTTPException(status_code=400, detail="账号不存在") + raise HTTPException(status_code=400, detail="验证码错误或已过期，请重新获取") key = _build_code_key(user.id) result = await db.execute(select(SystemSetting).where(SystemSetting.key == key)) setting = result.scalar_one_or_none()