From 1ba62e24f8767eb801d5db2e440657c669a80ab7 Mon Sep 17 00:00:00 2001
From: David Lawrence <dkl@mozilla.com>
Date: Thu, 12 Nov 2026 12:07:56 -0500
Subject: [PATCH] Bug 2090102

---
 Bugzilla/API/V1/UserObject.pm       | 3 +++
 qa/t/rest_user_update_credentials.t | 5 +++++
 2 files changed, 8 insertions(+)

diff --git a/Bugzilla/API/V1/UserObject.pm b/Bugzilla/API/V1/UserObject.pm
index fdeb0e59ba..d4d76b174b 100644
--- a/Bugzilla/API/V1/UserObject.pm
+++ b/Bugzilla/API/V1/UserObject.pm
@@ -511,6 +511,9 @@ sub update {
       $change->[0] = join(',', @{$change->[0]}) if ref $change->[0];
       $change->[1] = join(',', @{$change->[1]}) if ref $change->[1];
 
+      # Never return the password hash, only that it changed.
+      $change->[1] = '******' if $field eq 'cryptpassword';
+
       $hash{changes}{$field} = {
         removed => $self->type('string', $change->[0]),
         added   => $self->type('string', $change->[1])
diff --git a/qa/t/rest_user_update_credentials.t b/qa/t/rest_user_update_credentials.t
index 4c8e9f1ebd..af568a41c0 100644
--- a/qa/t/rest_user_update_credentials.t
+++ b/qa/t/rest_user_update_credentials.t
@@ -42,6 +42,11 @@ sub update_target {
 # Setting the same password still stores a new hash, so it shows as a change.
 my $changes = update_target({password => $target_password});
 ok(exists $changes->{cryptpassword}, 'password alone is a user field');
+is_deeply(
+  $changes->{cryptpassword},
+  {removed => '', added => '******'},
+  'the password hash is not returned'
+);
 
 $changes
   = update_target({email => $target_login, password => $target_password});