Merge branch 'fix'

application/Espo/Core/ORM/Type/FieldType.php

@@ -63,4 +63,5 @@ class FieldType
     public const WYSIWYG = 'wysiwyg';
     public const JSON_ARRAY = 'jsonArray';
     public const JSON_OBJECT = 'jsonObject';
+    public const PASSWORD = 'password';
 }

application/Espo/Core/Select/Order/Applier.php

@@ -76,6 +76,10 @@ class Applier
             if ($this->metadataProvider->isFieldOrderDisabled($this->entityType, $orderBy)) {
                 throw new Forbidden("Order by the field '$orderBy' is disabled.");
             }
+
+            if ($this->metadataProvider->getFieldType($this->entityType, $orderBy) === FieldType::PASSWORD) {
+                throw new Forbidden("Order by field '$orderBy' is not allowed.");
+            }
         }
 
         if ($orderBy === null) {

application/Espo/Resources/metadata/entityDefs/User.json

@@ -52,7 +52,8 @@
             "directAccessDisabled": true,
             "fieldManagerParamList": [
                 "tooltipText"
-            ]
+            ],
+            "orderDisabled": true
         },
         "passwordConfirm": {
             "type": "password",
@@ -88,7 +89,8 @@
                 "tooltipText"
             ],
             "copyToClipboard": true,
-            "dynamicLogicVisibleDisabled": true
+            "dynamicLogicVisibleDisabled": true,
+            "orderDisabled": true
         },
         "secretKey": {
             "type": "varchar",