From 058c0ac832666d9b8231fbb8cbc56773d7405f63 Mon Sep 17 00:00:00 2001
From: chaosBreaking <x491807573@qq.com>
Date: Fri, 6 Sep 2019 23:25:58 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E6=9B=B4=E6=94=B9=E5=AF=86=E7=A0=81?=
 =?UTF-8?q?=E4=BF=AE=E6=94=B9=E9=80=BB=E8=BE=91?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/modules/sign/sign.controller.js | 28 ++++++++++++----------------
 1 file changed, 12 insertions(+), 16 deletions(-)

diff --git a/src/modules/sign/sign.controller.js b/src/modules/sign/sign.controller.js
index d1f13f0..38d25a1 100644
--- a/src/modules/sign/sign.controller.js
+++ b/src/modules/sign/sign.controller.js
@@ -200,32 +200,28 @@ module.exports = {
     changePasswd: inject(function (SysConfig) {
         const { PWD_HASH_SALT } = SysConfig;
         return async (req, res) => {
-            const { phone, password, code } = req.body;
-            const validCode = await Code.verifyCode({
-                id: phone,
-                code,
-                type: CODE_TYPE['changePasswd']
-            });
-            if (!validCode) {
-                res.json({
+            const { userId } = res.locale.user;
+            const { password, newPassword } = req.body;
+            const user = User.findById(userId);
+            if (!user || user.password !== Crypto.hash(password, { salt: PWD_HASH_SALT }))
+                return res.json({
                     code: 1,
-                    msg: 'Incorrect code'
+                    msg: '原始密码错误'
                 });
-            }
-            const newPasswd = Crypto.hash(password, PWD_HASH_SALT);
-            const query = { phone };
-            const update = { password: newPasswd };
+            const newHashPasswd = Crypto.hash(newPassword, PWD_HASH_SALT);
+            const update = { password: newHashPasswd };
+            const success = await User.findByIdAndUpdate(userId, update, { new: true })
             // eslint-disable-next-line no-unused-vars
-            const success = await User.findOneAndUpdate(query, update, { new: true }).exec().catch(err => null);
+            .exec().catch(err => null);
             if (success) {
                 res.json({
                     code: 0,
-                    msg: 'Reseted passwd'
+                    msg: '密码重置成功'
                 });
             } else {
                 res.json({
                     code: 500,
-                    msg: 'unknow error'
+                    msg: '系统错误'
                 });
             }
         };