Pocket Query: How to prevent password visibility on datasource page.

[Wolf Wolfer]

When using pocketquery plugin and open datasource section all configured datasources including usernames passwords are plainly visible when viewing  "page source".

                       <ul id="databases-list" class="nice-list four-links">
                            <li data-entityname="qwerty" ><span class="content">qwerty</span><div class="link-container"><a href="#" class="icon icon-remove nice-remove" title="Remove Item"></a></div></li>
                                <script id="pocketquery-tmp-script">
                    PocketQuery.Admin.storeEntity('database', "qwerty", {"type":0,"name":"qwerty","url":"jdbc:oracle:thin:@123.123.123.123:2329/abc","user":"xyz","password":"abc","driver":"oracle.jdbc.driver.OracleDriver","testurl":"","applicationlinkid":"74f6db2c-65cb-3324-b2dc-8892b37ed719","consumerkey":"","consumersecret":"","token":"","tokensecret":"","signaturemethod":"","requestparameters":"","requestheaders":"","authurl":"","clientid":"","clientsecret":"","accesstoken":"","refreshtoken":""});
                    jQuery('#pocketquery-tmp-script').remove();
                </script>

This is a huge security issue from my pov (and probebly will result in deactivation of pocketquery in our company).

I wonder:

• Is everyone aware?
• Can this be prevented?

[Felix Grund (Scandio)]

Hi @Wolf Wolfer,

First of all, sorry for not replying on this. We are having some trouble following the posts on Atlassian community. In the future, feel free to post a question on our ServiceDesk and you'll receive prompt replies.

Regarding your question: this is actually default behavior of the HTML <input> field with `type="password"`. But certainly hiding the password in HTML can be achieved with workarounds and I agree that it would be very desirable in this scenario. Therefore, I now created an Improvement ticket and assigned it a high priority. Shouldn't take long!

Please feel free to follow-up on this!

Best, Felix