Radarr: Connection password retrievable on edit.

[jipjan]

Describe the bug
When editing a connection, it is possible to retrieve the current password from the edit modal using javascript.

To Reproduce
Steps to reproduce the behavior:

1. Go to Settings
2. Go to Connect tab
3. Edit an existing connection.
4. Run for example: $("input.form-control[name='fields.3.value']").val() in the javascript console.
5. See your password exposed.

Expected behavior
Password is not visible unless changes/manually filled out.

Desktop (please complete the following information):

• Browser: Chrome
• Version: 77.0.3865.90
• Radarr version: 0.2.0.1358 with Mono 5.20.1.34

One of the possible solutions would be implementing OAuth2 (for Plex at least), like Sonarr has (at least in the new UI).

[issue-label-bot[bot]]

Issue-Label Bot is automatically applying the label bug to this issue, with a confidence of 0.92. Please mark this comment with :thumbsup: or :thumbsdown: to give our bot feedback!

Links: app homepage, dashboard and code for this bot.

[Qstick]

You can do this same thing in the new Sonarr UI, $("input[name='password']").val(). If you want to protect this info, use auth on your Sonarr/Radarr instance.

[fryfrog]

I'm gonna close this, since it exists in Sonarr too. Maybe some day they'll get a security audit and a looking into, but I wouldn't expose any of this automation software. :)