From a0efc453f3834e5269596d3804884008d66653cf Mon Sep 17 00:00:00 2001 From: Paul Y Hui Date: Mon, 11 May 2026 15:02:24 +0800 Subject: [PATCH] Fix: safe argument guard and remove redundant redis call (#14060) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ### What problem does this PR solve? - Moved if not all([email, new_pwd, new_pwd2]) guard to the top, before any decryption that could crash on None value - Removed the redundant REDIS_CONN.get() call — one call is sufficient ### Type of change - [x] Bug Fix (non-breaking change which fixes an issue) - [x] Refactoring --- api/apps/restful_apis/user_api.py | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/api/apps/restful_apis/user_api.py b/api/apps/restful_apis/user_api.py index 714453ac6f..7ae99163d8 100644 --- a/api/apps/restful_apis/user_api.py +++ b/api/apps/restful_apis/user_api.py @@ -806,15 +806,15 @@ async def forget_reset_password(): new_pwd = req.get("new_password") new_pwd2 = req.get("confirm_new_password") - new_pwd_base64 = decrypt(new_pwd) - new_pwd_string = base64.b64decode(new_pwd_base64).decode('utf-8') - new_pwd2_string = base64.b64decode(decrypt(new_pwd2)).decode('utf-8') + if not all([email, new_pwd, new_pwd2]): + return get_json_result(data=False, code=RetCode.ARGUMENT_ERROR, message="email and passwords are required") if not REDIS_CONN.get(_verified_key(email)): return get_json_result(data=False, code=RetCode.AUTHENTICATION_ERROR, message="email not verified") - if not all([email, new_pwd, new_pwd2]): - return get_json_result(data=False, code=RetCode.ARGUMENT_ERROR, message="email and passwords are required") + new_pwd_base64 = decrypt(new_pwd) + new_pwd_string = base64.b64decode(new_pwd_base64).decode('utf-8') + new_pwd2_string = base64.b64decode(decrypt(new_pwd2)).decode('utf-8') if new_pwd_string != new_pwd2_string: return get_json_result(data=False, code=RetCode.ARGUMENT_ERROR, message="passwords do not match")