安全加固：LLM 会话按 (bot,peer) 隔离+历史上限50条，LLM 入队按 (bot,from_node) 限流(60s内5条)，瓦片磁盘缓存单源配额(3000文件/300MB 按mtime淘汰)，签到墙读接口限速+全站每日1000条封顶，敏感数据落盘 AES-256-GCM 加密(MESH_SECRET_KEY, 兼容明文迁移)，admin 改密需验证当前密码+pwd_version 会话撤销，后端 v1.5.0

meshmap_frontend/src/api.ts

@@ -307,8 +307,8 @@ export function createAdminUser(username: string, password: string): Promise<Adm
   return postJSON<AdminManagedUserResponse>('/api/admin/users', { username, password })
 }
 
-export function updateAdminUserPassword(id: number, password: string): Promise<AdminManagedUserResponse> {
-  return putJSON<AdminManagedUserResponse>(`/api/admin/users/${id}/password`, { password })
+export function updateAdminUserPassword(id: number, password: string, currentPassword: string): Promise<AdminManagedUserResponse> {
+  return putJSON<AdminManagedUserResponse>(`/api/admin/users/${id}/password`, { password, current_password: currentPassword })
 }
 
 export function getAdminLoginLogs(limit = 100, offset = 0): Promise<AdminLoginLogsResponse> {

meshmap_frontend/src/components/AdminUsers.vue

@@ -16,6 +16,7 @@ const newPassword = ref('')
 const confirmPassword = ref('')
 const passwordEdits = ref<Record<number, string>>({})
 const passwordSaving = ref<Record<number, boolean>>({})
+const currentPassword = ref('')
 
 function formatTime(value: string): string {
   return new Date(value).toLocaleString()
@@ -73,11 +74,16 @@ async function updatePassword(user: AdminManagedUser) {
     userError.value = '新密码不能为空'
     return
   }
+  if (!currentPassword.value) {
+    userError.value = '请输入当前登录密码'
+    return
+  }
 
   passwordSaving.value = { ...passwordSaving.value, [user.id]: true }
   try {
-    await updateAdminUserPassword(user.id, password)
+    await updateAdminUserPassword(user.id, password, currentPassword.value)
     passwordEdits.value = { ...passwordEdits.value, [user.id]: '' }
+    currentPassword.value = ''
     userMessage.value = `${user.username} 的密码已修改`
     await refreshUsers()
   } catch (err) {
@@ -129,6 +135,7 @@ onMounted(refreshUsers)
               <th class="cell-nowrap">创建时间</th>
               <th class="cell-nowrap">更新时间</th>
               <th>新密码</th>
+              <th class="cell-nowrap">当前登录密码</th>
               <th class="cell-nowrap">操作</th>
             </tr>
           </thead>
@@ -148,6 +155,15 @@ onMounted(refreshUsers)
                   placeholder="输入新密码"
                 />
               </td>
+              <td class="cell-nowrap">
+                <input
+                  v-model="currentPassword"
+                  class="admin-table-input"
+                  type="password"
+                  autocomplete="current-password"
+                  placeholder="当前登录密码(验证用)"
+                />
+              </td>
               <td class="cell-nowrap">
                 <button class="admin-button" :disabled="passwordSaving[managedUser.id]" @click="updatePassword(managedUser)">
                   {{ passwordSaving[managedUser.id] ? '保存中...' : '修改密码' }}