From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <vdavydov.dev@gmail.com>
Date: Fri, 14 Sep 2018 18:17:52 +0300
From: Vladimir Davydov <vdavydov.dev@gmail.com>
Subject: Re: [tarantool-patches] [PATCH] lua: fix assertion failure after
 improper box.schema.user:passwd() call
Message-ID: <20180914151752.f7f2nwa5dtpu334u@esperanza>
References: <20180910133643.22656-1-sergepetrenko@tarantool.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20180910133643.22656-1-sergepetrenko@tarantool.org>
To: Serge Petrenko <sergepetrenko@tarantool.org>
Cc: tarantool-patches@freelists.org
List-ID: <tarantool-patches.dev.tarantool.org>

On Mon, Sep 10, 2018 at 04:36:43PM +0300, Serge Petrenko wrote:
> Calling box.schema.user:passwd() instead of box.schema.user.passwd()
> leads to lua passing box.schema.user table as first function argument.
> This case was unhandled in box.schema.user.passwd() function and lead to
> an assertion failure.
> Fix this by handling the aforementioned case and add a test.
> 
> Closes #3659
> ---
> https://github.com/tarantool/tarantool/issues/3659
> https://github.com/tarantool/tarantool/tree/sp/gh-3659-assert-in-user-passwd
> 
>  src/box/lua/schema.lua | 2 +-
>  test/box/misc.result   | 8 ++++++++
>  test/box/misc.test.lua | 6 ++++++
>  3 files changed, 15 insertions(+), 1 deletion(-)
> 
> diff --git a/src/box/lua/schema.lua b/src/box/lua/schema.lua
> index 540a2a5fd..6b0c1cbb7 100644
> --- a/src/box/lua/schema.lua
> +++ b/src/box/lua/schema.lua
> @@ -2025,7 +2025,7 @@ local function chpasswd(uid, new_password)
>  end
>  
>  box.schema.user.passwd = function(name, new_password)
> -    if name == nil then
> +    if name == nil or type(name) == 'table' then
>          box.error(box.error.PROC_LUA, "Usage: box.schema.user.passwd([user,] password)")
>      end
>      if new_password == nil then

This isn't a proper fix, because the following command still crashes:

  box.schema.user.passwd(123)

And this one crashes too:

  box.session.su('admin', function(x) return #x end, 123)

Making error messages user-friendly is good, but I think that #3659 is
about invalid usage of luaT_error in lbox_session_su...