HOR-3433

Fix ProcessMaker User Password Hash Disclosure.

workflow/engine/classes/model/Users.php

@@ -490,4 +490,23 @@ class Users extends BaseUsers
         $criteria->add(UsersPeer::USR_ID, $id);
         return UsersPeer::doSelect($criteria)[0];
     }
+    
+    /**
+     * {@inheritdoc} except USR_PASSWORD, for security reasons.
+     *
+     * @param string $keyType One of the class type constants TYPE_PHPNAME,
+     *                        TYPE_COLNAME, TYPE_FIELDNAME, TYPE_NUM
+     * @return an associative array containing the field names (as keys) and field values
+     */
+    public function toArray($keyType = BasePeer::TYPE_PHPNAME)
+    {
+        $key = UsersPeer::translateFieldName(
+            UsersPeer::USR_PASSWORD,
+            BasePeer::TYPE_COLNAME,
+            $keyType
+        );
+        $array = parent::toArray($keyType);
+        unset($array[$key]);
+        return $array;
+    }
 }