Datasource passwords are displayed in plaintext

[kuhball]

NetBox version

v3.5.1

Python version

3.8

Steps to Reproduce

1. Create a new Datasource with a token or user/password
2. Open core/data-sources/<ID>/
3. Password is displayed in plaintext and also visible for readonly users

Expected Behavior

Password should be hidden.

Observed Behavior

Password is displayed as plaintext for all users with access to datasources.

[jeremystretch]

What is the proposed "fix?"

[kuhball]

Similar to the Wireless LAN Authentication Attributes ( https://github.com/netbox-community/netbox/blob/develop/netbox/templates/wireless/inc/authentication_attrs.html ) the field could be hidden. Having secrets/passwords displayed without hiding them is also problematic for demo / screen share / audit scenarios.

Having the Show Secret button only available for write permissions would solve our permission problem.

[aroth01]

i can try to take a shot at this one. i'm a bit new to contributing though. Could do a change to the password field to display only for users that have add/update/delete permissions. Then hide it for those users and display it when the show secret button is pressed. Users that don't have those permissions wouldn't be able to see the password.

[jeremystretch]

Reclassifying this as a feature request, as the described behavior was never part of the original implementation.

[ryanmerolle]

I do not think this implementation is working. I upgraded on my setup and saw password is still shown in the UI for data sources.

Repeatable example: https://demo.netbox.dev/core/data-sources/1/