From 7a484c0788f14412bd0531fdd021b4b292145bc5 Mon Sep 17 00:00:00 2001
From: zeripath <art27@cantab.net>
Date: Mon, 31 May 2021 11:46:20 +0100
Subject: [PATCH] Hide mirror passwords on repo settings page (#16022)

This PR simply hides mirror passwords from being displayed on the repo settings page.

Signed-off-by: Andrew Thornton <art27@cantab.net>

Co-authored-by: techknowlogick <techknowlogick@gitea.io>
---
 options/locale/locale_en-US.ini      | 5 ++++-
 routers/repo/setting.go              | 6 ++++++
 templates/repo/settings/options.tmpl | 3 ++-
 3 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/options/locale/locale_en-US.ini b/options/locale/locale_en-US.ini
index 1d39f99425..4df9965bcb 100644
--- a/options/locale/locale_en-US.ini
+++ b/options/locale/locale_en-US.ini
@@ -732,6 +732,9 @@ mirror_lfs_desc = Activate mirroring of LFS data.
 mirror_lfs_endpoint = LFS Endpoint
 mirror_lfs_endpoint_desc = Sync will attempt to use the clone url to <a target="_blank" rel="noopener noreferrer" href="%s">determine the LFS server</a>. You can also specify a custom endpoint if the repository LFS data is stored somewhere else.
 mirror_last_synced = Last Synchronized
+mirror_password_placeholder = (Unchanged)
+mirror_password_blank_placeholder = (Unset)
+mirror_password_help = Change the username to erase a stored password.
 watchers = Watchers
 stargazers = Stargazers
 forks = Forks
@@ -1316,7 +1319,7 @@ pulls.manually_merged_as = The pull request has been manually merged as <a rel="
 pulls.is_closed = The pull request has been closed.
 pulls.has_merged = The pull request has been merged.
 pulls.title_wip_desc = `<a href="#">Start the title with <strong>%s</strong></a> to prevent the pull request from being merged accidentally.`
-pulls.cannot_merge_work_in_progress = This pull request is marked as a work in progress. 
+pulls.cannot_merge_work_in_progress = This pull request is marked as a work in progress.
 pulls.still_in_progress = Still in progress?
 pulls.add_prefix = Add <strong>%s</strong> prefix
 pulls.remove_prefix = Remove <strong>%s</strong> prefix
diff --git a/routers/repo/setting.go b/routers/repo/setting.go
index 51bf68b15b..51a0e01164 100644
--- a/routers/repo/setting.go
+++ b/routers/repo/setting.go
@@ -166,6 +166,12 @@ func SettingsPost(ctx *context.Context) {
 			}
 		}
 
+		oldUsername := mirror_service.Username(ctx.Repo.Mirror)
+		oldPassword := mirror_service.Password(ctx.Repo.Mirror)
+		if form.MirrorPassword == "" && form.MirrorUsername == oldUsername {
+			form.MirrorPassword = oldPassword
+		}
+
 		address, err := forms.ParseRemoteAddr(form.MirrorAddress, form.MirrorUsername, form.MirrorPassword)
 		if err == nil {
 			err = migrations.IsMigrateURLAllowed(address, ctx.User)
diff --git a/templates/repo/settings/options.tmpl b/templates/repo/settings/options.tmpl
index fb4b65dbad..ece439f3d9 100644
--- a/templates/repo/settings/options.tmpl
+++ b/templates/repo/settings/options.tmpl
@@ -106,8 +106,9 @@
 							<input class="fake" type="password">
 							<div class="inline field {{if .Err_Auth}}error{{end}}">
 								<label for="mirror_password">{{.i18n.Tr "password"}}</label>
-								<input id="mirror_password" name="mirror_password" type="password" value="{{MirrorPassword .Mirror}}" {{if not .mirror_password}}data-need-clear="true"{{end}} autocomplete="off">
+								<input id="mirror_password" name="mirror_password" type="password" placeholder="{{if MirrorPassword .Mirror }}{{.i18n.Tr "repo.mirror_password_placeholder"}}{{else}}{{.i18n.Tr "repo.mirror_password_blank_placeholder"}}{{end}}" value="" {{if not .mirror_password}}data-need-clear="true"{{end}} autocomplete="off">
 							</div>
+							<p class="help">{{.i18n.Tr "repo.mirror_password_help"}}</p>
 						</div>
 					</details>