Abnormal behaviour when username and password are empty

[gideonlegrange]

Abnormal behaviour when username and password are empty

[GideonLeGrange]

I can reproduce the problem. I am working on a solution, and will update the issue.

[GideonLeGrange]

I've fixed it, and the API will now throw an exception if the user tries to log in with a empty (0 length or string full of spaces) username. Empty passwords are valid and are still allowed.

The fix is in the master branch, and I will release v2.0.3 for this bug shortly.

More detail, if you're interested:

The way the Mikrotik API works internally caused this problem. The user side sends a "/login" command, receives a hash, and then sends a second "/login" command using this hash and the username. This overloading of "/login" would have been fine if the Mikrotik side was prepared to handle the situation where a empty username with a valid hash is received. By handle I don't mean accept a blank username, simply return an error. But what they do if the username is empty, is to just return another hash.

So the fix was quite simple:

        if (username.trim().isEmpty()) {
            throw new ApiConnectionException("API username cannot be empty");
        }

Thank you for reporting this. I hope it resolves the issue for you.

Gideon

[laviua]

Yes, right, thanks!