User password export / import broken

Problem/Motivation

I tried to prepare users on my dev system giving them passwords, export them and deploy them to the target system. This did not work as intended. The export contains the hashed passwords alright, as is to be expected. But after import into the target system it was not possible to log in using the password I had chosen.

The hash value in the users table was not equal to the one in the export json file. I had a hunch as to what may have happened so I tried to log in giving the hash from the file as clear text password and the login succeeded. So importing a user will cause the string under "pass" to be sent through the hashing function another time instead of being used as-is.

Steps to reproduce

• Create a user on the source system with a known password
• Export the user
• Import the user on the target system
• Provide the clear text password. This will fail.
• Try it with the value from the exported file. This will succeed.

Proposed resolution

Do not hash the already hashed password a second time when importing.