Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Smtp creds are visible to end user - Security Risk #1524

Open
ckieler-cb opened this issue Jul 3, 2024 · 0 comments
Open

Smtp creds are visible to end user - Security Risk #1524

ckieler-cb opened this issue Jul 3, 2024 · 0 comments

Comments

@ckieler-cb
Copy link

ckieler-cb commented Jul 3, 2024

Hello,

If we set LockSettings = true

The window for the settings shows and if the user has provided smtp credentials (under message relay tab) they can open dev tools and remove the type="password" to expose the smtp password.

image

image

In previous versions of this tool, the ability to open the window was disabled altogether via LockSettings = true.

Could the frontend be updated to not include the actual values when LockSettings = true ?

# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant