volspotconnect2 ver0.4.0 - Spotify account password retrievable via developer console

[martinbeentjes]

At the office we are using volumio for the radio. We installed Volumio Spotify Connect2 ver0.4.0 to connect to Spotify. I joined the team a while ago, this configuration was in use already for a while.

I wanted to add my own Spotify account so I can control the music. When your spotify credentials are entered and saved, the values stay there even if a full page reload happens.

When another colleague opens the plugin settings, they can retrieve my Spotify password by removing the type="password" attribute in the Developer Console. This is a major password leak.

The credentials should not be filled in automatically.

Note: This issue was also reported at a fork of this repo.