tarantool / tarantool-php

PECL PHP driver for Tarantool
http://tarantool.org/
Other
86 stars 24 forks source link

When no password provided, the connector tries to connect as guest #165

Open Totktonada opened 4 years ago

Totktonada commented 4 years ago

Connector version: 0.3.3-0-ge67cb23.

Cited from https://github.com/tarantool/tarantool-php/pull/142#discussion_r453932061:

It seems, if only username is passed (but no password) the client will silently connect as 'guest' user without a password. What a hell…

If I change the following && to ||:

https://github.com/tarantool/tarantool-php/blob/e67cb231d48219d1f01cf1e5b4c3cc93d8004f9f/src/tarantool.c#L309

Then I got TarantoolClientError: Invalid MsgPack - authentication request body.

That's all looks as a bug.

Reproducer

First console:

$ tarantool
tarantool> box.cfg{listen = '127.0.0.1:3301'}
tarantool> box.schema.user.grant('guest','read,write,execute,create,drop,alter','universe')
tarantool> box.schema.user.create('test', {password = '1234'})
tarantool> box.schema.user.grant('test','read,write,execute,create,drop,alter','universe')

Second console:

$ phpize
$ ./configure
$ make
$ php -a -d "extension=$(realpath modules/tarantool.so)"
php > $res = (new Tarantool('127.0.0.1', 3301, 'test'))->call('box.session.user');
php > var_dump($res);
array(1) {
  [0]=>
  array(1) {
    [0]=>
    string(5) "guest"
  }
}

The same for the empty password.

It is at least counter-intuitive. We should either try to connect without a password (with the empty password?) or give an error when a user is provided (and not guest), but a password is not.