Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Smtp creds are visible to end user - Security Risk #1524

Open
ckieler-cb opened this issue Jul 3, 2024 · 0 comments
Open

Smtp creds are visible to end user - Security Risk #1524

ckieler-cb opened this issue Jul 3, 2024 · 0 comments

Comments

@ckieler-cb
Copy link

ckieler-cb commented Jul 3, 2024

Hello,

If we set LockSettings = true

The window for the settings shows and if the user has provided smtp credentials (under message relay tab) they can open dev tools and remove the type="password" to expose the smtp password.

image

image

In previous versions of this tool, the ability to open the window was disabled altogether via LockSettings = true.

Could the frontend be updated to not include the actual values when LockSettings = true ?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant