From 654c2ca7b688c31de2f5583c8113afb25d120a0e Mon Sep 17 00:00:00 2001
From: Kevin Chung <kchung@nyu.edu>
Date: Wed, 25 Oct 2017 13:56:04 -0400
Subject: [PATCH] Don't render the mail server password on the config page
 (#428)

* Remove the currently set configuration if the checkbox is unchecked
* Closes #422
---
 CTFd/admin/__init__.py                  | 11 +++++++++--
 CTFd/themes/admin/templates/config.html | 25 ++++++++++++++++---------
 2 files changed, 25 insertions(+), 11 deletions(-)

diff --git a/CTFd/admin/__init__.py b/CTFd/admin/__init__.py
index d153c42e..2504e9e7 100644
--- a/CTFd/admin/__init__.py
+++ b/CTFd/admin/__init__.py
@@ -143,8 +143,15 @@ def admin_config():
         mail_server = utils.set_config("mail_server", request.form.get('mail_server', None))
         mail_port = utils.set_config("mail_port", request.form.get('mail_port', None))
 
-        mail_username = utils.set_config("mail_username", request.form.get('mail_username', None))
-        mail_password = utils.set_config("mail_password", request.form.get('mail_password', None))
+        if request.form.get('mail_useauth', None) and (request.form.get('mail_u', None) or request.form.get('mail_p', None)):
+            if len(request.form.get('mail_u')) > 0:
+                mail_username = utils.set_config("mail_username", request.form.get('mail_u', None))
+            if len(request.form.get('mail_p')) > 0:
+                mail_password = utils.set_config("mail_password", request.form.get('mail_p', None))
+
+        elif request.form.get('mail_useauth', None) is None:
+            utils.set_config("mail_username", None)
+            utils.set_config("mail_password", None)
 
         ctf_name = utils.set_config("ctf_name", request.form.get('ctf_name', None))
         ctf_theme = utils.set_config("ctf_theme", request.form.get('ctf_theme', None))
diff --git a/CTFd/themes/admin/templates/config.html b/CTFd/themes/admin/templates/config.html
index 397b21a7..00a074b3 100644
--- a/CTFd/themes/admin/templates/config.html
+++ b/CTFd/themes/admin/templates/config.html
@@ -3,7 +3,7 @@
 {% block content %}
 <div class="row">
 	<h1>Config</h1>
-	<form method="POST">
+	<form method="POST" autocomplete="off">
 		<div class="col-md-2 col-md-offset-2">
 			<ul class="nav nav-pills nav-stacked">
 				<li role="presentation" class="active">
@@ -133,22 +133,29 @@
 							<div class="checkbox">
 							<label>
 								<input id="mail_useauth" name="mail_useauth" type="checkbox" {% if mail_useauth %}checked{% endif %}>
-									Specify Username and Password
+									Use Mail Server Username and Password
 								</label>
 							</div>
 							<div id="mail_username_password">
 								<div class="form-group">
 									<label for="start">Username:</label>
-									<input class="form-control" id='mail_username' name='mail_username' type='text'
-											placeholder="Username"
-											{% if mail_username is defined and mail_username != None %}value="{{ mail_username }}"{% endif %}>
+									{% if mail_username is defined and mail_username != None %}
+										<label for="mail_u"><sup>A mail server username is currently set</sup></label>
+									{% endif %}
+									<input class="form-control" id='mail_u' name='mail_u' autocomplete='off' type='text'
+											placeholder="Username">
 								</div>
 								<div class="form-group">
-									<label for="start">Password:</label>
-									<input class="form-control" id='mail_password' name='mail_password' type='password'
-											placeholder="Password"
-											{% if mail_password is defined and mail_password != None %}value="{{ mail_password }}"{% endif %}>
+									<label for="mail_p">Password:</label>
+									{% if mail_password is defined and mail_password != None %}
+										<label for="mail_p"><sup>An mail server password is currently set</sup></label>
+									{% endif %}
+									<input class="form-control" id='mail_p' name='mail_p' autocomplete='off' type='password'
+											placeholder="Password">
 								</div>
+                                <sup>Uncheck setting and update to remove username and password</sup>
+                                <br>
+                                <br>
 							</div>
 							<div class="checkbox">
 								<label>