fix: requirepass allows connection with any non-empty password

Author: caiyu

src/acl.cc

@@ -497,6 +497,10 @@ void Acl::InitLimitUser(const std::string& bl, bool limit_exist) {
     }
     if (!pass.empty()) {
       u->SetUser(">" + pass);
+    }else{
+      //If the userpass password is empty, 
+      //disable the limit user to prevent password-free access
+      u->SetUser("off");
     }
   } else {
     if (pass.empty()) {

tests/integration/acl_test.go

@@ -124,5 +124,22 @@ var _ = Describe("Acl test", func() {
 		Expect(err).NotTo(HaveOccurred())
 		Expect(len(logEntries)).To(Equal(0))
 	})
-
+	// Test case for the bug: any non-empty requirepass could connect when requirepass is set.
+	// pika.conf: requirepass abc
+	It("has wrong password returns error and correct password returns OK", func() {
+		ctx := context.TODO()
+		client := redis.NewClient(&redis.Options{
+			Addr: "127.0.0.1:9221",
+		})
+		authRes := client.Do(ctx, "auth", "wrongpass")
+		Expect(authRes.Err()).To(MatchError("WRONGPASS invalid username-password pair or user is disabled."))
+		client.Close()
+		client = redis.NewClient(&redis.Options{
+			Addr: "127.0.0.1:9221",
+		})
+		authRes = client.Do(ctx, "auth", "abc")
+		Expect(authRes.Err()).NotTo(HaveOccurred())
+		Expect(authRes.Val()).To(Equal("OK"))
+		client.Close()
+	})
 })