From 2e69e4faf673cd72f42de5d680f9fcb1e08b3643 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Krier?= <ced@b2ck.com>
Date: Tue, 30 Aug 2016 12:12:55 +0200
Subject: [PATCH] Prevent read of user password hash

changeset c9be44cd05e1 did not add the same hiding protection to the new
password_hash field as the password field.
This allow any authenticated user to read the hash of any other user.

CVE-2016-1241
issue5795
review32441002
---
 CHANGELOG           | 1 +
 trytond/res/user.py | 8 ++++++++
 2 files changed, 9 insertions(+)

diff --git a/CHANGELOG b/CHANGELOG
index 2569add662..423b14d7fc 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,4 @@
+* Prevent read of user password hash (CVE-2016-1241)
 * Add database dump cache for tests
 * Remove unused tools: find_in_path, exec_command_pipe and mod10r
 * Implementation of drop_column for SQLite
diff --git a/trytond/res/user.py b/trytond/res/user.py
index 60bb938c32..898e54ef6a 100644
--- a/trytond/res/user.py
+++ b/trytond/res/user.py
@@ -232,6 +232,14 @@ class User(ModelSQL, ModelView):
             vals['menu'] = Action.get_action_id(vals['menu'])
         return vals
 
+    @classmethod
+    def read(cls, ids, fields_names=None):
+        result = super(User, cls).read(ids, fields_names=fields_names)
+        if not fields_names or 'password_hash' in fields_names:
+            for values in result:
+                values['password_hash'] = None
+        return result
+
     @classmethod
     def create(cls, vlist):
         vlist = [cls._convert_vals(vals) for vals in vlist]