From b0e89eac00e365d11bc574f291677dc5303ce4d2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Krier?= <ced@b2ck.com>
Date: Tue, 7 Mar 2023 16:33:58 +0100
Subject: [PATCH] Remove password hash also from the transaction cache

Closes #12120
---
 trytond/trytond/res/user.py | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/trytond/trytond/res/user.py b/trytond/trytond/res/user.py
index ac9cffbcfb..0c3908ae09 100644
--- a/trytond/trytond/res/user.py
+++ b/trytond/trytond/res/user.py
@@ -364,11 +364,28 @@ class User(avatar_mixin(100, 'login'), DeactivableMixin, ModelSQL, ModelView):
     @classmethod
     def read(cls, ids, fields_names):
         result = super(User, cls).read(ids, fields_names)
-        if not fields_names or 'password_hash' in fields_names:
-            for values in result:
+        cache = Transaction().get_cache()[cls.__name__]
+        for values in result:
+            if 'password_hash' in values:
                 values['password_hash'] = None
+            if values['id'] in cache:
+                cache[values['id']]['password_hash'] = None
         return result
 
+    @classmethod
+    def search(
+            cls, domain, offset=0, limit=None, order=None, count=False,
+            query=False):
+        users = super().search(
+            domain, offset=offset, limit=limit, order=order, count=count,
+            query=query)
+        cache = Transaction().get_cache()[cls.__name__]
+        if not count and not query:
+            for user in users:
+                if user.id in cache:
+                    cache[user.id]['password_hash'] = None
+        return users
+
     @classmethod
     def create(cls, vlist):
         vlist = [cls._convert_vals(vals) for vals in vlist]