Open
Description
Connector version: 0.3.3-0-ge67cb23.
Cited from #142 (comment):
It seems, if only username is passed (but no password) the client will silently connect as 'guest' user without a password. What a hell…
If I change the following
&&
to||
:Line 309 in e67cb23
Then I got
TarantoolClientError: Invalid MsgPack - authentication request body
.That's all looks as a bug.
Reproducer
First console:
$ tarantool
tarantool> box.cfg{listen = '127.0.0.1:3301'}
tarantool> box.schema.user.grant('guest','read,write,execute,create,drop,alter','universe')
tarantool> box.schema.user.create('test', {password = '1234'})
tarantool> box.schema.user.grant('test','read,write,execute,create,drop,alter','universe')
Second console:
$ phpize
$ ./configure
$ make
$ php -a -d "extension=$(realpath modules/tarantool.so)"
php > $res = (new Tarantool('127.0.0.1', 3301, 'test'))->call('box.session.user');
php > var_dump($res);
array(1) {
[0]=>
array(1) {
[0]=>
string(5) "guest"
}
}
The same for the empty password.
It is at least counter-intuitive. We should either try to connect without a password (with the empty password?) or give an error when a user is provided (and not guest
), but a password is not.