XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests

@@ -75,9 +75,10 @@
   #foreach($colname in $collist)
     ## If a classname is defined and the class field corresponding to the column name,
     ## we check the type of the field and skip it if it's Password.
-    #if ($className != '' && $class.get($colname))
-      #set ($isPasswordType = $class.get($colname).classType == 'Password')
-      #set ($isEmailType = $class.get($colname).classType == 'Email')
+    #livetable_getPropertyClassAndType($colname)
+    #if ($propType != '')
+      #set ($isPasswordType = $propClass.get($colname).classType == 'Password')
+      #set ($isEmailType = $propClass.get($colname).classType == 'Email')
       #set ($emailObfuscated = $services.mail.general.shouldObfuscate())
       #if (!($isPasswordType || ($isEmailType && $emailObfuscated)))
         #livetable_addColumnToQuery($colname)

@@ -567,6 +567,32 @@ void cleanupAccessToPasswordFields() throws Exception
             + "and doc.fullName not in (:classTemplate1, :classTemplate2)  ");
     }
 
+    @Test
+    void noAccessToPasswordFieldsWithClassPerProperty() throws Exception
+    {
+        // Initialize an XClass with a password field.
+        DocumentReference documentReference = new DocumentReference("xwiki", "XWiki", "MyClass");
+        XWikiDocument xwikiDocument = this.xwiki.getDocument(documentReference, this.context);
+        BaseClass xClass = xwikiDocument.getXClass();
+        xClass.addPasswordField("password", "Password", 30);
+        this.xwiki.saveDocument(xwikiDocument, this.context);
+
+        when(this.queryService.hql(anyString())).thenReturn(this.query);
+        when(this.query.setLimit(anyInt())).thenReturn(this.query);
+        when(this.query.setOffset(anyInt())).thenReturn(this.query);
+        when(this.query.bindValues(any(Map.class))).thenReturn(this.query);
+        when(this.query.count()).thenReturn(0L);
+        when(this.query.execute()).thenReturn(Collections.emptyList());
+
+        this.request.put("password", "abcd");
+        this.request.put("password_class", "XWiki.MyClass");
+        this.request.put("collist", "password");
+
+        renderPage();
+
+        verify(this.queryService).hql("  where 1=1  ");
+    }
+
     @Test
     void highLimitIsRejected() throws Exception
     {