fix version 1

module/base/mgt/internal/logic/pub/login.go

@@ -1,8 +1,6 @@
 package pub
 
 import (
-	"crypto/md5"
-	"encoding/hex"
 	"errors"
 	"fmt"
 	"strconv"
@@ -72,7 +70,7 @@ func Login(c *gin.Context) {
 	resp = types.LoginResp{Phone: user.Phone, Email: user.Email, Name: user.Name, UserId: user.ID, Account: user.Account, Avatar: user.Avatar, Identity: user.Identity}
 	// 检测Password与Status
 	if request.AppKey != "" {
-		err = checkAppKeyAndStatus(user.Password, pwd, int16(user.Status))
+		err = checkAppKeyAndStatus(user.Password, pwd, user.Salt, int16(user.Status))
 	} else {
 		err = checkPwdAndStatus(user.Password, pwd, user.Salt, int16(user.Status))
 	}
@@ -122,30 +120,18 @@ func checkPwdAndStatus(userPwd, inPwd, salt string, stat int16) error {
 		return errcode.ErrUnavailable
 	}
 
-	err := bcrypt.CompareHashAndPassword([]byte(userPwd), []byte(inPwd+salt))
-	if err == nil {
-		return nil
-	}
-
-	// 如果bcrypt失败，尝试MD5验证（向后兼容旧用户）
-	isBcrypt := len(userPwd) > 4 && (userPwd[0:4] == "$2a$" || userPwd[0:4] == "$2b$" || userPwd[0:4] == "$2y$")
-	if isBcrypt {
-		printer.Error("密码验证失败: bcrypt验证失败")
+	// 统一使用 bcrypt 比对，不再保留 MD5 兼容分支
+	if err := bcrypt.CompareHashAndPassword([]byte(userPwd), []byte(inPwd+salt)); err != nil {
+		printer.Error("密码验证失败: bcrypt 比对不通过")
 		return errcode.ErrPassword
 	}
 
-	hash := md5.Sum([]byte(inPwd + salt))
-	md5Hash := hex.EncodeToString(hash[:])
-	if userPwd == md5Hash {
-		return nil
-	}
-
-	printer.Error("密码验证失败: 所有验证方式均失败")
-	return errcode.ErrPassword
+	return nil
 }
 
-func checkAppKeyAndStatus(userPwd, pwd string, stat int16) error {
-	if userPwd != pwd {
+func checkAppKeyAndStatus(userPwd, pwd, salt string, stat int16) error {
+	// AppKey 与账号密码同源存储（bcrypt(密码+salt)），必须做哈希比对，禁止明文相等比对密码列
+	if err := bcrypt.CompareHashAndPassword([]byte(userPwd), []byte(pwd+salt)); err != nil {
 		printer.Error("检查密码异常: 密码不匹配")
 		return errcode.ErrPassword
 	}