Bug 2090102

Bugzilla/API/V1/UserObject.pm

@@ -511,6 +511,9 @@ sub update {
       $change->[0] = join(',', @{$change->[0]}) if ref $change->[0];
       $change->[1] = join(',', @{$change->[1]}) if ref $change->[1];
 
+      # Never return the password hash, only that it changed.
+      $change->[1] = '******' if $field eq 'cryptpassword';
+
       $hash{changes}{$field} = {
         removed => $self->type('string', $change->[0]),
         added   => $self->type('string', $change->[1])

qa/t/rest_user_update_credentials.t

@@ -42,6 +42,11 @@ sub update_target {
 # Setting the same password still stores a new hash, so it shows as a change.
 my $changes = update_target({password => $target_password});
 ok(exists $changes->{cryptpassword}, 'password alone is a user field');
+is_deeply(
+  $changes->{cryptpassword},
+  {removed => '', added => '******'},
+  'the password hash is not returned'
+);
 
 $changes
   = update_target({email => $target_login, password => $target_password});