tarantool-php
tarantool-php copied to clipboard
When no password provided, the connector tries to connect as guest
Connector version: 0.3.3-0-ge67cb23.
Cited from https://github.com/tarantool/tarantool-php/pull/142#discussion_r453932061:
It seems, if only username is passed (but no password) the client will silently connect as 'guest' user without a password. What a hell…
If I change the following
&&
to||
:https://github.com/tarantool/tarantool-php/blob/e67cb231d48219d1f01cf1e5b4c3cc93d8004f9f/src/tarantool.c#L309
Then I got
TarantoolClientError: Invalid MsgPack - authentication request body
.That's all looks as a bug.
Reproducer
First console:
$ tarantool
tarantool> box.cfg{listen = '127.0.0.1:3301'}
tarantool> box.schema.user.grant('guest','read,write,execute,create,drop,alter','universe')
tarantool> box.schema.user.create('test', {password = '1234'})
tarantool> box.schema.user.grant('test','read,write,execute,create,drop,alter','universe')
Second console:
$ phpize
$ ./configure
$ make
$ php -a -d "extension=$(realpath modules/tarantool.so)"
php > $res = (new Tarantool('127.0.0.1', 3301, 'test'))->call('box.session.user');
php > var_dump($res);
array(1) {
[0]=>
array(1) {
[0]=>
string(5) "guest"
}
}
The same for the empty password.
It is at least counter-intuitive. We should either try to connect without a password (with the empty password?) or give an error when a user is provided (and not guest
), but a password is not.