Fixed CRITICAL SECURITY ISSUE of SMTP password visible to Admin at

Admin Panel by using browser inspect to see behind asterisks.

Thanks to Georg Krause and xet7 !

client/components/settings/settingBody.jade

@@ -97,7 +97,7 @@ template(name='email')
     li.smtp-form
       .title {{_ 'smtp-password'}}
       .form-group
-        input.wekan-form-control#mail-server-password(type="password", placeholder="{{_ 'password'}}" value="{{currentSetting.mailServer.password}}")
+        input.wekan-form-control#mail-server-password(type="password", placeholder="{{_ 'password'}}" value="")
     li.smtp-form
       .title {{_ 'smtp-tls'}}
       .form-group

server/publications/settings.js

@@ -31,7 +31,18 @@ Meteor.publish('mailServer', function() {
   if (!Match.test(this.userId, String)) return [];
   const user = Users.findOne(this.userId);
   if (user && user.isAdmin) {
-    return Settings.find({}, { fields: { mailServer: 1 } });
+    return Settings.find(
+      {},
+      {
+        fields: {
+          'mailServer.host': 1,
+          'mailServer.port': 1,
+          'mailServer.username': 1,
+          'mailServer.enableTLS': 1,
+          'mailServer.from': 1,
+        },
+      },
+    );
   }
   return [];
 });