diff --git a/app/admin/controller/user.go b/app/admin/controller/user.go
index 9d29d5f..f0e413a 100644
--- a/app/admin/controller/user.go
+++ b/app/admin/controller/user.go
@@ -32,7 +32,8 @@ func (a *User) Update(ctx *gin.Context) {
 		err2.ParamErr("<user update>", err)
 	}
 	// 获取当前登录用户的账号
-	userinfo := service.NewToken().UserInfo(ctx.GetHeader("token"))
+	loginUser := service.NewToken().UserInfo(ctx.GetHeader("token"))
+	userinfo := loginUser
 	if userId := cast.ToInt64(req.UserId); userId != 0 {
 		userinfo, err = dao.NewUser().GetUserId(userId)
 		if userinfo == nil {
@@ -41,7 +42,7 @@ func (a *User) Update(ctx *gin.Context) {
 	}
 
 	userService := service.NewUser(userinfo)
-	userService.Update(req)
+	userService.Update(req, loginUser.ID)
 	ctx.JSON(http.StatusOK, response.NewRspOk())
 }
 
diff --git a/app/admin/request/user.go b/app/admin/request/user.go
index b611d67..b5b4d9e 100644
--- a/app/admin/request/user.go
+++ b/app/admin/request/user.go
@@ -10,11 +10,12 @@ type UserCreate struct {
 }
 
 type UserUpdate struct {
-	UserId   string `json:"id"`
-	Username string `json:"username"`
-	Password string `json:"password"`
-	Role     string `json:"role"`
-	Status   string `json:"status"`
+	UserId      string `json:"id"`
+	Username    string `json:"username"`
+	Password    string `json:"password"`
+	OldPassword string `json:"old_password"`
+	Role        string `json:"role"`
+	Status      string `json:"status"`
 }
 
 type UserDelete struct {
diff --git a/app/admin/service/user.go b/app/admin/service/user.go
index c5f4b08..137dbac 100644
--- a/app/admin/service/user.go
+++ b/app/admin/service/user.go
@@ -86,7 +86,7 @@ func (a *User) Create(req request.UserCreate) int64 {
 	return m.ID
 }
 
-func (a *User) Update(req request.UserUpdate) {
+func (a *User) Update(req request.UserUpdate, operatorID int64) {
 	var user *model.User
 	var err error
 	user, err = dao.NewUser().AccountGet(a.user.Account)
@@ -119,6 +119,12 @@ func (a *User) Update(req request.UserUpdate) {
 	req.Password = strings.TrimSpace(req.Password)
 	if req.Password != "" {
 		checkPassword(req.Password)
+		if user.ID == operatorID {
+			oldPassword := strings.TrimSpace(req.OldPassword)
+			if user.Password != goutil.Md5(oldPassword+model.Salt) {
+				err2.ParamErr("旧密码错误")
+			}
+		}
 		user.Password = goutil.Md5(req.Password + model.Salt)
 	}