diff --git a/module/common/model.php b/module/common/model.php
index 40f7f5c0c9..d41c0772be 100644
--- a/module/common/model.php
+++ b/module/common/model.php
@@ -1137,6 +1137,7 @@ class commonModel extends model
         $acls    = $app->user->rights['acls'];
         $module  = strtolower($module);
         $method  = strtolower($method);
+
         if(isset($rights[$module][$method]))
         {
             if(empty($acls['views'])) return true;
diff --git a/module/my/control.php b/module/my/control.php
index e532e89b17..2ddd668857 100644
--- a/module/my/control.php
+++ b/module/my/control.php
@@ -338,6 +338,7 @@ class my extends control
         $this->view->title      = $this->lang->my->common . $this->lang->colon . $this->lang->my->editProfile;
         $this->view->position[] = $this->lang->my->editProfile;
         $this->view->user       = $this->user->getById($this->app->user->account);
+        $this->view->rand       = $this->user->updateSessionRandom();
 
         $this->display();
     }
diff --git a/module/my/js/editprofile.js b/module/my/js/editprofile.js
new file mode 100644
index 0000000000..e585d83bcd
--- /dev/null
+++ b/module/my/js/editprofile.js
@@ -0,0 +1,9 @@
+$(document).ready(function()
+{
+    $('#dataform').submit(function()
+    {
+        var password = $('input#verifyPassword').val();
+        var rand = $('input#verifyRand').val();
+        $('input#verifyPassword').val(md5(md5(password) + rand));
+    });
+});
diff --git a/module/my/view/editprofile.html.php b/module/my/view/editprofile.html.php
index b948b6c043..278a2853bd 100644
--- a/module/my/view/editprofile.html.php
+++ b/module/my/view/editprofile.html.php
@@ -12,11 +12,12 @@
 ?>
 <?php include '../../common/view/header.html.php';?>
 <?php include '../../common/view/datepicker.html.php';?>
+<?php js::import($jsRoot . 'md5.js');?>
 <div class='container mw-800px'>
   <div id='titlebar'>
     <div class='heading'><i class='icon-pencil'></i> <?php echo $lang->my->editProfile;?></div>
   </div>
-  <form method='post' target='hiddenwin' class='form-condensed'>
+  <form method='post' target='hiddenwin' class='form-condensed' id='dataform'>
     <fieldset>
       <legend><?php echo $lang->my->form->lblBasic;?></legend>
       <table class='table table-form'> 
@@ -113,6 +114,7 @@
     </fieldset>
     <div class='text-center'><?php echo html::submitButton() . ' &nbsp; ' . html::backButton();?></div>
   </form>
+  <?php echo html::hidden('verifyRand', $rand);?>
 </div>
 <?php js::set('passwordStrengthList', $lang->user->passwordStrengthList)?>
 <script>
diff --git a/module/user/control.php b/module/user/control.php
index 0d7eb13536..3d07936dd5 100644
--- a/module/user/control.php
+++ b/module/user/control.php
@@ -414,6 +414,7 @@ class user extends control
         $this->view->groupList = $groupList;
         $this->view->roleGroup = $roleGroup;
         $this->view->deptID    = $deptID;
+        $this->view->rand      = $this->user->updateSessionRandom();
 
         $this->display();
     }
@@ -460,6 +461,7 @@ class user extends control
         $this->view->deptID    = $deptID;
         $this->view->groupList = $groupList;
         $this->view->roleGroup = $roleGroup;
+        $this->view->rand      = $this->user->updateSessionRandom();
 
         $this->display();
     }
@@ -494,7 +496,8 @@ class user extends control
         $this->view->depts      = $this->dept->getOptionMenu();
         $this->view->userGroups = implode(',', array_keys($userGroups));
         $this->view->groups     = $this->loadModel('group')->getPairs();
- 
+
+        $this->view->rand = $this->user->updateSessionRandom();
         $this->display();
     }
 
@@ -528,6 +531,8 @@ class user extends control
         $this->view->title      = $this->lang->company->common . $this->lang->colon . $this->lang->user->batchEdit;
         $this->view->position[] = $this->lang->user->batchEdit;
         $this->view->depts      = $this->dept->getOptionMenu();
+        $this->view->rand       = $this->user->updateSessionRandom();
+
         $this->display();
     }
 
@@ -545,7 +550,7 @@ class user extends control
         if($this->app->user->admin and $this->app->user->account == $user->account) return;
         if($_POST)
         {
-            if(md5($this->post->verifyPassword) != $this->app->user->password) die(js::alert($this->lang->user->error->verifyPassword));
+            if($this->post->verifyPassword != md5($this->app->user->password . $this->session->rand)) die(js::alert($this->lang->user->error->verifyPassword));
             $this->user->delete(TABLE_USER, $userID);
             if(!dao::isError())
             {
@@ -571,6 +576,7 @@ class user extends control
             die(js::locate($this->session->userList, 'parent.parent'));
         }
 
+        $this->view->rand = $this->user->updateSessionRandom();
         $this->display();
     }
 
@@ -760,7 +766,7 @@ class user extends control
             }
         }
         else
-        { 
+        {
             if(!empty($this->config->global->showDemoUsers))
             {
                 $demoUsers = $this->user->getPairs('noletter|noempty|noclosed|nodeleted');
@@ -773,6 +779,7 @@ class user extends control
             $this->view->referer   = $this->referer;
             $this->view->s         = zget($this->config->global, 'sn', '');
             $this->view->keepLogin = $this->cookie->keepLogin ? $this->cookie->keepLogin : 'off';
+            $this->view->rand      = $this->user->updateSessionRandom();
             $this->display();
         }
     }
diff --git a/module/user/js/common.js b/module/user/js/common.js
index 90ac0cf41b..a688eb1fa3 100644
--- a/module/user/js/common.js
+++ b/module/user/js/common.js
@@ -6,6 +6,16 @@
  * @access public
  * @return void
  */
+$(document).ready(function()
+{
+    $('#dataform').submit(function()
+    {
+        var password = $('input#verifyPassword').val();
+        var rand = $('input#verifyRand').val();
+        $('input#verifyPassword').val(md5(md5(password) + rand));
+    });
+});
+
 function switchAccount(account, method)
 {
     if(method == 'dynamic')
diff --git a/module/user/js/login.js b/module/user/js/login.js
index b4e47bd9f9..da2ad639a4 100644
--- a/module/user/js/login.js
+++ b/module/user/js/login.js
@@ -21,6 +21,7 @@ $(document).ready(function()
     $('#login-form form').submit(function()
     {
         var password = $('input:password').val();
-        if(password.length != 32 && typeof(md5) == 'function') $('input:password').val(md5(password));
+        var rand = $('input#verifyRand').val();
+        if(password.length != 32 && typeof(md5) == 'function') $('input:password').val(md5(md5(password) + rand));
     });
 })
diff --git a/module/user/model.php b/module/user/model.php
index 279abef0f4..210050faff 100644
--- a/module/user/model.php
+++ b/module/user/model.php
@@ -221,7 +221,7 @@ class userModel extends model
             return false;
         }
 
-        if(empty($_POST['verifyPassword']) or md5($this->post->verifyPassword) != $this->app->user->password)
+        if(empty($_POST['verifyPassword']) or $this->post->verifyPassword != md5($this->app->user->password . $this->session->rand))
         {
             dao::$errors['verifyPassword'][] = $this->lang->user->error->verifyPassword;
             return false;
@@ -258,7 +258,7 @@ class userModel extends model
      */
     public function batchCreate()
     {
-        if(empty($_POST['verifyPassword']) or md5($this->post->verifyPassword) != $this->app->user->password) die(js::alert($this->lang->user->error->verifyPassword));
+        if(empty($_POST['verifyPassword']) or $this->post->verifyPassword != md5($this->app->user->password . $this->session->rand)) die(js::alert($this->lang->user->error->verifyPassword));
 
         $users    = fixer::input('post')->get(); 
         $data     = array();
@@ -369,7 +369,7 @@ class userModel extends model
             return false;
         }
 
-        if(empty($_POST['verifyPassword']) or md5($this->post->verifyPassword) != $this->app->user->password)
+        if(empty($_POST['verifyPassword']) or $this->post->verifyPassword != md5($this->app->user->password . $this->session->rand))
         {
             dao::$errors['verifyPassword'][] = $this->lang->user->error->verifyPassword;
             return false;
@@ -420,16 +420,30 @@ class userModel extends model
         }
     }
 
+    /**
+     * update session random.
+     *
+     * @access public
+     * @return void
+     */
+    public function updateSessionRandom()
+    {
+        $random = mt_rand();
+        $this->session->set('rand', $random);
+
+        return $random;
+    }
+
     /**
      * Batch edit user.
-     * 
+     *
      * @access public
      * @return void
      */
     public function batchEdit()
     {
         $data = fixer::input('post')->get();
-        if(empty($_POST['verifyPassword']) or md5($this->post->verifyPassword) != $this->app->user->password) die(js::alert($this->lang->user->error->verifyPassword));
+        if(empty($_POST['verifyPassword']) or $this->post->verifyPassword != md5($this->app->user->password . $this->session->rand)) die(js::alert($this->lang->user->error->verifyPassword));
 
         $oldUsers     = $this->dao->select('id, account, email')->from(TABLE_USER)->where('id')->in(array_keys($data->account))->fetchAll('id');
         $accountGroup = $this->dao->select('id, account')->from(TABLE_USER)->where('account')->in($data->account)->fetchGroup('account', 'id');
diff --git a/module/user/view/batchcreate.html.php b/module/user/view/batchcreate.html.php
index a8b645af32..9989a3a032 100644
--- a/module/user/view/batchcreate.html.php
+++ b/module/user/view/batchcreate.html.php
@@ -12,6 +12,7 @@
 ?>
 <?php include '../../common/view/header.html.php';?>
 <?php include '../../common/view/datepicker.html.php';?>
+<?php js::import($jsRoot . 'md5.js');?>
 <?php js::set('roleGroup', $roleGroup);?>
 <div id='titlebar'>
   <div class='heading'>
@@ -101,6 +102,7 @@ $minWidth = (count($visibleFields) > 5) ? 'w-150px' : '';
     <tr><td colspan='<?php echo count($visibleFields) + 6?>' class='text-center'><?php echo html::submitButton() . html::backButton();?></td></tr>
   </table>
 </form>
+<?php echo html::hidden('verifyRand', $rand);?>
 <?php $customLink = $this->createLink('custom', 'ajaxSaveCustomFields', 'module=user&section=custom&key=batchCreateFields')?>
 <?php include '../../common/view/customfield.html.php';?>
 <?php include '../../common/view/footer.html.php';?>
diff --git a/module/user/view/batchedit.html.php b/module/user/view/batchedit.html.php
index 7898154573..ee2624613e 100644
--- a/module/user/view/batchedit.html.php
+++ b/module/user/view/batchedit.html.php
@@ -12,6 +12,7 @@
 ?>
 <?php include '../../common/view/header.html.php';?>
 <?php include '../../common/view/datepicker.html.php';?>
+<?php js::import($jsRoot . 'md5.js');?>
 <div id='titlebar'>
   <div class='heading'>
     <span class='prefix'><?php echo html::icon($lang->icons['user']);?></span>
@@ -93,6 +94,7 @@ $minWidth = (count($visibleFields) > 7) ? 'w-120px' : '';
     <tr><td colspan='<?php echo count($visibleFields) + 4?>' class='text-center'><?php echo html::submitButton() . html::backButton();?></td></tr>
   </table>
 </form>
+<?php echo html::hidden('verifyRand', $rand);?>
 <?php $customLink = $this->createLink('custom', 'ajaxSaveCustomFields', 'module=user&section=custom&key=batchEditFields')?>
 <?php include '../../common/view/customfield.html.php';?>
 <?php include '../../common/view/footer.html.php';?>
diff --git a/module/user/view/create.html.php b/module/user/view/create.html.php
index c6ebee1de3..95d34dd32f 100644
--- a/module/user/view/create.html.php
+++ b/module/user/view/create.html.php
@@ -12,6 +12,7 @@
 ?>
 <?php include '../../common/view/header.html.php';?>
 <?php include '../../common/view/datepicker.html.php';?>
+<?php js::import($jsRoot . 'md5.js');?>
 <?php if(!empty($config->safe->mode)) $lang->user->placeholder->password1 = $lang->user->placeholder->passwordStrength[$config->safe->mode]?>
 <?php js::set('holders', $lang->user->placeholder);?>
 <?php js::set('roleGroup', $roleGroup);?>
@@ -83,10 +84,10 @@
           <?php echo html::password('verifyPassword', '', "class='form-control disabled-ie-placeholder' autocomplete='off' placeholder='{$lang->user->placeholder->verify}'");?>
         </td>
       </tr>
-
       <tr><th></th><td><?php echo html::submitButton() . html::backButton();?></td></tr>
     </table>
   </form>
+  <?php echo html::hidden('verifyRand', $rand);?>
 </div>
 <?php js::set('passwordStrengthList', $lang->user->passwordStrengthList)?>
 <?php include '../../common/view/footer.html.php';?>
diff --git a/module/user/view/delete.html.php b/module/user/view/delete.html.php
index 3aa3b6e929..12ba657cba 100644
--- a/module/user/view/delete.html.php
+++ b/module/user/view/delete.html.php
@@ -11,12 +11,13 @@
  */
 ?>
 <?php include '../../common/view/header.lite.html.php';?>
+<?php js::import($jsRoot . 'md5.js');?>
 <div id='titlebar'>
   <div class='heading'>
     <strong><?php echo $lang->user->delete;?></strong>
   </div>
 </div>
-<form class='form-condensed' method='post' target='hiddenwin' style='padding: 20px 5% 40px'>
+<form class='form-condensed' method='post' id='dataform' target='hiddenwin' style='padding: 20px 5% 40px'>
   <table class='w-p100 table-form'>
     <tr>
       <th class='w-120px text-right'>
@@ -30,4 +31,5 @@
     </tr>
   </table>
 </form>
+<?php echo html::hidden('verifyRand', $rand);?>
 <?php include '../../common/view/footer.lite.html.php';?>
diff --git a/module/user/view/edit.html.php b/module/user/view/edit.html.php
index c1b00d9f34..4a03320217 100644
--- a/module/user/view/edit.html.php
+++ b/module/user/view/edit.html.php
@@ -12,6 +12,7 @@
 ?>
 <?php include '../../common/view/header.html.php';?>
 <?php include '../../common/view/datepicker.html.php';?>
+<?php js::import($jsRoot . 'md5.js');?>
 <div class='container mw-800px'>
   <div id='titlebar'>
     <div class='heading'>
@@ -115,6 +116,7 @@
       <tr><td colspan='2' class='text-center'><?php echo html::submitButton() . html::backButton();?></td></tr>
     </table>
   </form>
+  <?php echo html::hidden('verifyRand', $rand);?>
 </div>
 <?php js::set('passwordStrengthList', $lang->user->passwordStrengthList)?>
 <?php include '../../common/view/footer.html.php';?>
diff --git a/module/user/view/login.html.php b/module/user/view/login.html.php
index f5e93a9bfb..c0abc274ef 100644
--- a/module/user/view/login.html.php
+++ b/module/user/view/login.html.php
@@ -74,6 +74,7 @@ if(empty($config->notMd5Pwd))js::import($jsRoot . 'md5.js');
     <?php if($config->checkVersion):?>
     <iframe id='updater' class='hidden' frameborder='0' width='100%' scrolling='no' allowtransparency='true' src="http://api.zentao.net/updater-isLatest-<?php echo $config->version;?>-<?php echo $s;?>.html?lang=<?php echo str_replace('-', '_', $this->app->getClientLang())?>"></iframe>
     <?php endif;?>
+    <?php echo html::hidden('verifyRand', $rand);?>
   </div>
 </div>
 <?php include '../../common/view/footer.lite.html.php';?>