Open Totktonada opened 4 years ago
Connector version: 0.3.3-0-ge67cb23.
Cited from https://github.com/tarantool/tarantool-php/pull/142#discussion_r453932061:
It seems, if only username is passed (but no password) the client will silently connect as 'guest' user without a password. What a hell… If I change the following && to ||: https://github.com/tarantool/tarantool-php/blob/e67cb231d48219d1f01cf1e5b4c3cc93d8004f9f/src/tarantool.c#L309 Then I got TarantoolClientError: Invalid MsgPack - authentication request body. That's all looks as a bug.
It seems, if only username is passed (but no password) the client will silently connect as 'guest' user without a password. What a hell…
If I change the following && to ||:
&&
||
https://github.com/tarantool/tarantool-php/blob/e67cb231d48219d1f01cf1e5b4c3cc93d8004f9f/src/tarantool.c#L309
Then I got TarantoolClientError: Invalid MsgPack - authentication request body.
TarantoolClientError: Invalid MsgPack - authentication request body
That's all looks as a bug.
First console:
$ tarantool tarantool> box.cfg{listen = '127.0.0.1:3301'} tarantool> box.schema.user.grant('guest','read,write,execute,create,drop,alter','universe') tarantool> box.schema.user.create('test', {password = '1234'}) tarantool> box.schema.user.grant('test','read,write,execute,create,drop,alter','universe')
Second console:
$ phpize $ ./configure $ make $ php -a -d "extension=$(realpath modules/tarantool.so)" php > $res = (new Tarantool('127.0.0.1', 3301, 'test'))->call('box.session.user'); php > var_dump($res); array(1) { [0]=> array(1) { [0]=> string(5) "guest" } }
The same for the empty password.
It is at least counter-intuitive. We should either try to connect without a password (with the empty password?) or give an error when a user is provided (and not guest), but a password is not.
guest
Connector version: 0.3.3-0-ge67cb23.
Cited from https://github.com/tarantool/tarantool-php/pull/142#discussion_r453932061:
Reproducer
First console:
Second console:
The same for the empty password.
It is at least counter-intuitive. We should either try to connect without a password (with the empty password?) or give an error when a user is provided (and not
guest
), but a password is not.