UI exposes password of last installed VM
Gnome Boxes exposes the password of the last installed VM, which I guess is a security concern.
The 'Express Installation' UI suggests the password from the last installation as a default value. By toggling the password field's visibility it can be read in cleartext. Afaik the password is also stored and displayed across reboots.
Reproduce:
- Install a VM using 'Express Installation', setting username+password
- After the installation, launch the 'Express Installation' UI again
-> The password from the previous installation is visible in the 'Password' field.
- Gnome Boxes:
42.3-17184268
Edited by Reto Kaiser