fix: requirepass allows connection with any non-empty password (#3113)

YuCai18 · caiyu · web-flow · commit 9018370ce7b7 · 2025-06-20T11:41:04.000+08:00
Co-authored-by: caiyu &lt;15260903118@163.com&gt;
diff --git a/src/acl.cc b/src/acl.cc
@@ -497,6 +497,10 @@ void Acl::InitLimitUser(const std::string& bl, bool limit_exist) {
     }
     if (!pass.empty()) {
       u->SetUser(">" + pass);
+    } else {
+      //If the userpass password is empty, 
+      //disable the limit user to prevent password-free access
+      u->SetUser("off");
     }
   } else {
     if (pass.empty()) {

Original file line number	Diff line number	Diff line change
`@@ -497,6 +497,10 @@ void Acl::InitLimitUser(const std::string& bl, bool limit_exist) {`
`497`	`497`	`}`
`498`	`498`	`if (!pass.empty()) {`
`499`	`499`	`u->SetUser(">" + pass);`
	`500`	`+ } else {`
	`501`	`+ //If the userpass password is empty,`
	`502`	`+ //disable the limit user to prevent password-free access`
	`503`	`+ u->SetUser("off");`
`500`	`504`	`}`
`501`	`505`	`} else {`
`502`	`506`	`if (pass.empty()) {`