Avoid rehashing user password hashes in {add,update}_global_user()

[mpkut]

In 6.2.32 and 6.2.34, our testing shows that using the GUI to add an existing address to a list causes the user's current password hash to be rehashed and stored. This renders the user's password unusable and effectively forces a password reset sequence. The behavior seems to correspond with the spontaneous password reinitialization problem discussed in #269.

This targeted fix uses hash_type() to detect password hashes and avoid rehashing them. For the sake of consistent behavior, both update_global_user() and add_global_user() are updated.

The change does not address all of the design concerns of #269 but in our testing it does prevent the seemingly spontaneous password resets caused by being added to a list using the GUI.

[ikedas]

This looks a workaround for issue #167. We would be better to add it to the next beta (6.2.35b.1) and to see what will occur. So I'll merge.

[ikedas]

I made additional changes to track the bug: e02945f

[mpkut]

Thank you!

BTW I would not see this as a workaround for #167; that seems to be a password reset loop. We have seen those too, in two varieties: 1) stored form data in browsers, and 2) people remaining on the password reset page even when they have successfully chosen a password. In both cases, clearing cookies and manually entering the form data seems to help.

In contrast, the band-aid in this PR is about keeping other people from invalidating your password hash simply by adding you to a list using WWSympa. Of course, encountering that situation will increase your chance of entering one of the password reset loop scenarios, which is what we've seen lately.

[ikedas]

Hi @mpkut,

Honestly, I have not grasped what causes the bug reported in #167: Password field is overwritten unexpectedly. I hope your first aid will help making it clear. When sympa spews err log, please let us know.

[mpkut]

Hello @ikedas
We installed the updated logging code this evening and pretty much immediately started seeing log messages. Here is a brief sample.

rehash-errors.txt

[mpkut]

And along with do_add and do_subscribe, here are some stemming from do_auth.

do_auth-errors.txt