CVE-2016-1241

@@ -37,6 +37,7 @@ def create_user(self, login, password, hash_method=None):
             User.write([user], {
                     'password': password,
                     })
+        return user
 
     def check_user(self, login, password):
         pool = Pool()
@@ -72,6 +73,12 @@ def test_test_bcrypt(self):
         self.create_user('user', '12345', 'bcrypt')
         self.check_user('user', '12345')
 
+    @with_transaction()
+    def test_read_password_hash(self):
+        "Test password_hash can not be read"
+        user = self.create_user('user', '12345')
+        self.assertIsNone(user.password_hash)
+
 
 def suite():
     return unittest.TestLoader().loadTestsFromTestCase(UserTestCase)

@@ -1,3 +1,4 @@
+* Prevent read of user password hash (CVE-2016-1241)
 * Add database dump cache for tests
 * Remove unused tools: find_in_path, exec_command_pipe and mod10r
 * Implementation of drop_column for SQLite

@@ -232,6 +232,14 @@ def _convert_vals(vals):
             vals['menu'] = Action.get_action_id(vals['menu'])
         return vals
 
+    @classmethod
+    def read(cls, ids, fields_names=None):
+        result = super(User, cls).read(ids, fields_names=fields_names)
+        if not fields_names or 'password_hash' in fields_names:
+            for values in result:
+                values['password_hash'] = None
+        return result
+
     @classmethod
     def create(cls, vlist):
         vlist = [cls._convert_vals(vals) for vals in vlist]