username and password missing from saved configuration and HTTP requests

[jayhendren]

After updating to 2.64 (sorry I don't know what the previous version was; I last updated at the end of last week so I suspect 2.63), the value for the fields user, password, proxyUser, and proxyPassword on all of my notifications have changed to KEEP_THIS_TO_LEAVE_UNCHANGED and cannot be updated. For instance, here is an attempt to update these values via the API...

[birdsnest ~]% curl 'https://my.bitbucket.server/rest/prnfb-admin/1.0/settings/notifications/' -XPOST -u 'username:password' -H 'Content-Type: application/json; charset=UTF-8' -H 'Accept: application/json, text/javascript, */*; q=0.01' --data-binary '{"method":"POST","name":"trigger rescan of repository","password":"********","projectKey":"SC","repositorySlug":"cub_test","triggerIfCanMerge":"NOT_CONFLICTING","triggers":["OPENED","BUTTON_TRIGGER","REOPENED","RESCOPED_FROM","RESCOPED_TO","UPDATED"],"url":"https://my.jenkins.server/job/test/job/cub_test/build","user":"configman-test","uuid":"8ad2841e-1cd4-495e-a276-82220b6043df"}'
{"headers":[],"method":"POST","name":"trigger rescan of repository","password":"KEEP_THIS_TO_LEAVE_UNCHANGED","proxyPassword":"KEEP_THIS_TO_LEAVE_UNCHANGED","proxyUser":"KEEP_THIS_TO_LEAVE_UNCHANGED","triggerIfCanMerge":"NOT_CONFLICTING","triggerIgnoreStateList":[],"triggers":["OPENED","BUTTON_TRIGGER","REOPENED","RESCOPED_FROM","RESCOPED_TO","UPDATED"],"url":"https://my.jenkins.server/job/test/job/cub_test/build","user":"KEEP_THIS_TO_LEAVE_UNCHANGED","uuid":"8ad2841e-1cd4-495e-a276-82220b6043df","postContentEncoding":"NONE"}% 

... and when I inspect the requests generated by this configuration, the HTTP basic authentication headers are missing.

[jayhendren]

I can confirm that downgrading to 2.63 fixes the issue. Authentication headers are being sent again.

[tomasbjerre]

Are you downgrading without re-saving the user/password?

[tomasbjerre]

Try latest release from marketplace. Should be fixed now.

The value KEEP_THIS_TO_LEAVE_UNCHANGED in the responses is intended. To avoid exposing the plain credentials.