Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

When no password provided, the connector tries to connect as guest #165

Open
Totktonada opened this issue Jul 14, 2020 · 0 comments
Open
Labels
backlog bug Something isn't working prio5

Comments

@Totktonada
Copy link
Member

Connector version: 0.3.3-0-ge67cb23.

Cited from #142 (comment):

It seems, if only username is passed (but no password) the client will silently connect as 'guest' user without a password. What a hell…

If I change the following && to ||:

if (obj->login != NULL && obj->passwd != NULL) {

Then I got TarantoolClientError: Invalid MsgPack - authentication request body.

That's all looks as a bug.

Reproducer

First console:

$ tarantool
tarantool> box.cfg{listen = '127.0.0.1:3301'}
tarantool> box.schema.user.grant('guest','read,write,execute,create,drop,alter','universe')
tarantool> box.schema.user.create('test', {password = '1234'})
tarantool> box.schema.user.grant('test','read,write,execute,create,drop,alter','universe')

Second console:

$ phpize
$ ./configure
$ make
$ php -a -d "extension=$(realpath modules/tarantool.so)"
php > $res = (new Tarantool('127.0.0.1', 3301, 'test'))->call('box.session.user');
php > var_dump($res);
array(1) {
  [0]=>
  array(1) {
    [0]=>
    string(5) "guest"
  }
}

The same for the empty password.

It is at least counter-intuitive. We should either try to connect without a password (with the empty password?) or give an error when a user is provided (and not guest), but a password is not.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backlog bug Something isn't working prio5
Projects
None yet
Development

No branches or pull requests

2 participants