diff --git a/module/common/model.php b/module/common/model.php
index e514f9453a..4a5a8963bd 100644
--- a/module/common/model.php
+++ b/module/common/model.php
@@ -170,6 +170,7 @@ class commonModel extends model
         if($module == 'sso' and $method == 'gettodolist') return true;
         if($module == 'product' and $method == 'showerrornone') return true;
         if($module == 'block' and $method == 'printblock') return true;
+        if($module == 'block' and $method == 'main') return true;
 
         if($this->loadModel('user')->isLogon())
         {
diff --git a/module/sso/control.php b/module/sso/control.php
index 46abbf3894..546587fd4f 100644
--- a/module/sso/control.php
+++ b/module/sso/control.php
@@ -192,6 +192,7 @@ class sso extends control
      */
     public function getUserPairs()
     {
+        if(!$this->sso->checkKey()) return false;
         $users = $this->loadModel('user')->getPairs('noclosed,nodeleted');
         die(json_encode($users));
     }
@@ -204,6 +205,7 @@ class sso extends control
      */
     public function getBindUsers()
     {
+        if(!$this->sso->checkKey()) return false;
         $users = $this->sso->getBindUsers();
         die(json_encode($users));
     }
@@ -250,6 +252,8 @@ class sso extends control
      */
     public function getTodoList($account = '')
     {
+        if(!$this->sso->checkKey()) return false;
+
         $datas = array();
         $datas['task'] = $this->dao->select("id, name")->from(TABLE_TASK)->where('assignedTo')->eq($account)->andWhere('status')->in('wait,doing')->fetchPairs();
         $datas['bug']  = $this->dao->select("id, title")->from(TABLE_BUG)->where('assignedTo')->eq($account)->andWhere('status')->eq('active')->fetchPairs();
diff --git a/module/user/control.php b/module/user/control.php
index 7a23d5a648..bff9861684 100644
--- a/module/user/control.php
+++ b/module/user/control.php
@@ -660,7 +660,7 @@ class user extends control
             if($this->post->account)  $account  = $this->post->account;
             if($this->get->account)   $account  = $this->get->account;
             if($this->post->password) $password = $this->post->password;
-            if($this->get->password)  $password = $this->get->password;
+            if($this->get->password)  $password = base64_decode($this->get->password);
 
             if($this->user->checkLocked($account))
             {