Rework unhashed admin password visibility
When creating a new local admin user (/admin/user/add-admin-user.xhtml
), you can only input Name and Password. Which saves the password without hashing.
And since an (master?)admin can see the password value of each admin user as part of the user details, by default all passwords are visible as plaintext.
Only when changing the password of an already existing account, you can choose a hash algorithm.
I suggest to not even enable unhashed passwords. And/Or the passwords should not be displayed in the GUI.