fix: handle decryption of encrypted password and data in user password reset flow

Author: wxg0103

apps/users/serializers/user.py

@@ -7,6 +7,7 @@
     @desc:
 """
 import datetime
+import json
 import os
 import random
 import re
@@ -119,7 +120,8 @@ def profile(user: User, auth: Auth):
             'source': user.source,
             'role': auth.role_list,
             'permissions': auth.permission_list,
-            'is_edit_password': password_verify(CONFIG.get('DEFAULT_PASSWORD', 'MaxKB@123..'), user.password) if user.source == 'LOCAL' else False,
+            'is_edit_password': password_verify(CONFIG.get('DEFAULT_PASSWORD', 'MaxKB@123..'),
+                                                user.password) if user.source == 'LOCAL' else False,
             'language': user.language,
             'workspace_list': workspace_list,
             'role_name': role_name
@@ -514,6 +516,16 @@ def one(self, with_valid=True):
         def re_password(self, instance, with_valid=True):
             if with_valid:
                 self.is_valid(raise_exception=True)
+                encrypted_data = instance.get("encryptedData", "")
+                if encrypted_data:
+                    try:
+                        decrypted_raw = decrypt(encrypted_data)
+                        # decrypt 可能返回非 JSON 字符串，防护解析异常
+                        decrypted_data = json.loads(decrypted_raw) if decrypted_raw else {}
+                        if isinstance(decrypted_data, dict):
+                            instance.update(decrypted_data)
+                    except Exception as e:
+                        raise AppApiException(500, _("Invalid encrypted data"))
                 UserManageSerializer.RePasswordInstance(data=instance).is_valid(raise_exception=True)
             user = User.objects.filter(id=self.data.get('id')).first()
             user.password = password_encrypt(instance.get('password'))

apps/users/views/user.py

@@ -6,6 +6,8 @@
     @date：2025/4/14 19:25
     @desc:
 """
+import json
+
 from django.core.cache import cache
 from django.db.models import QuerySet
 from django.utils.translation import gettext_lazy as _
@@ -17,9 +19,11 @@
 from common.auth.authentication import has_permissions
 from common.constants.cache_version import Cache_Version
 from common.constants.permission_constants import PermissionConstants, Permission, Group, Operate, RoleConstants
+from common.exception.app_exception import AppApiException
 from common.log.log import log
 from common.result import result
 from common.utils.common import query_params_to_single_dict
+from common.utils.rsa_util import decrypt
 from maxkb.const import CONFIG
 from models_provider.api.model import DefaultModelResponse
 from tools.serializers.tool import encryption
@@ -299,7 +303,11 @@ class RePasswordView(APIView):
          get_operation_object=lambda r, k: {'name': r.user.username},
          get_details=get_re_password_details)
     def post(self, request: Request):
-        serializer_obj = RePasswordSerializer(data=request.data)
+        request_data = request.data
+        if request_data.get("encrypted", False):
+            request_data['password'] = decrypt(request_data.get('password'))
+            request_data['re_password'] = decrypt(request_data.get('re_password'))
+        serializer_obj = RePasswordSerializer(data=request_data)
         return result.success(serializer_obj.reset_password())
 
 
@@ -371,7 +379,18 @@ class ResetCurrentUserPasswordView(APIView):
     @has_permissions(PermissionConstants.CHANGE_PASSWORD, RoleConstants.ADMIN, RoleConstants.USER,
                      RoleConstants.WORKSPACE_MANAGE)
     def post(self, request: Request):
-        serializer_obj = ResetCurrentUserPassword(data=request.data)
+        request_data = request.data
+        encrypted_data = request_data.get("encryptedData", "")
+        if encrypted_data:
+            try:
+                decrypted_raw = decrypt(encrypted_data)
+                # decrypt 可能返回非 JSON 字符串，防护解析异常
+                decrypted_data = json.loads(decrypted_raw) if decrypted_raw else {}
+                if isinstance(decrypted_data, dict):
+                    request_data = decrypted_data
+            except Exception as e:
+                raise AppApiException(500, _("Invalid encrypted data"))
+        serializer_obj = ResetCurrentUserPassword(data=request_data)
         if serializer_obj.reset_password(request.user.id):
             version, get_key = Cache_Version.TOKEN.value
             cache.delete(get_key(token=request.auth), version=version)