feat: only send password from the frontend if it has changed

app/javascript/dashboard/routes/dashboard/settings/inbox/ImapSettings.vue

@@ -65,6 +65,7 @@ export default {
     async updateInbox() {
       try {
         this.loading = true;
+
         let payload = {
           id: this.inbox.id,
           formData: false,
@@ -73,11 +74,16 @@ export default {
             imap_address: this.address,
             imap_port: this.port,
             imap_login: this.login,
-            imap_password: this.password,
             imap_enable_ssl: this.isSSLEnabled,
           },
         };
 
+        // If the password is a placeholder, don't send it to the server
+        const isPlaceholderPassword = /^\*+$/.test(this.password);
+        if (!isPlaceholderPassword) {
+          payload.channel.imap_password = this.password;
+        }
+
         if (!this.isIMAPEnabled) {
           payload.channel.smtp_enabled = false;
         }

app/javascript/dashboard/routes/dashboard/settings/inbox/SmtpSettings.vue

@@ -134,7 +134,6 @@ export default {
             smtp_address: this.address,
             smtp_port: this.port,
             smtp_login: this.login,
-            smtp_password: this.password,
             smtp_domain: this.domain,
             smtp_enable_ssl_tls: this.ssl,
             smtp_enable_starttls_auto: this.starttls,
@@ -142,6 +141,12 @@ export default {
             smtp_authentication: this.authMechanism,
           },
         };
+
+        const isPlaceholderPassword = /^\*+$/.test(this.password);
+        if (!isPlaceholderPassword) {
+          payload.channel.smtp_password = this.password;
+        }
+
         await this.$store.dispatch('inboxes/updateInboxSMTP', payload);
         useAlert(this.$t('INBOX_MGMT.SMTP.EDIT.SUCCESS_MESSAGE'));
       } catch (error) {

app/models/channel/email.rb

@@ -65,6 +65,14 @@ class Channel::Email < ApplicationRecord
     imap_enabled && imap_address == 'imap.gmail.com'
   end
 
+  def obfuscated_imap_password
+    imap_password.present? ? '********' : nil
+  end
+
+  def obfuscated_smtp_password
+    smtp_password.present? ? '********' : nil
+  end
+
   private
 
   def ensure_forward_to_email

app/views/api/v1/models/_inbox.json.jbuilder

@@ -67,7 +67,7 @@ if resource.email?
   ## IMAP
   if Current.account_user&.administrator?
     json.imap_login resource.channel.try(:imap_login)
-    json.imap_password resource.channel.try(:imap_password)
+    json.imap_password resource.channel.try(:obfuscated_imap_password)
     json.imap_address resource.channel.try(:imap_address)
     json.imap_port resource.channel.try(:imap_port)
     json.imap_enabled resource.channel.try(:imap_enabled)
@@ -81,7 +81,7 @@ if resource.email?
   ## SMTP
   if Current.account_user&.administrator?
     json.smtp_login resource.channel.try(:smtp_login)
-    json.smtp_password resource.channel.try(:smtp_password)
+    json.smtp_password resource.channel.try(:obfuscated_smtp_password)
     json.smtp_address resource.channel.try(:smtp_address)
     json.smtp_port resource.channel.try(:smtp_port)
     json.smtp_enabled resource.channel.try(:smtp_enabled)