[Security] Shared accounts can change the password

Hi,

I just noticed that passwords for accounts on tracker.projeqtor.org and demo.projeqtor.org can be changed easily from the login screen. This looks like a security issue to me (hopefully, the admin can still revert this back but you don't want to reset the password every morning).
To me, a shared account should not be able to change password and access the user parameters (the latter can be changed) but the admin should be able to change the user parameters if needed.

Thank you,

But your tracker is not the only ProjeQtOr instance where shared accounts exists.
I have an account with read-only access to ProjeQtOr used by I don't know how many people, maybe 30, maybe 50, and I don't want them to be able to change the password.
Same goes for our suppliers, I don't know how many resources they have.
Thank you for considering the issue,