Check that user_hash_password() is defined

@skwashd well, password.inc is not included during the bootstrap...
My scenario was user entities (node authors) as dependencies of deployed nodes (deploy module pushes to services module on another server)

  if (isset($entity->pass)
    && (!('$S$D' == substr($entity->pass, 0, 4)) || preg_match('/^[a-f0-9]{32}$/', $entity->pass))) {
    // Ensure user's password is hashed.
    $entity->pass = user_hash_password($entity->pass);
  }

@skwashd as you (writefully) mentioned in #2724323: UUID Services update user with pass saved in plain text on database, the most frequently used scenario is deploy module (site A) pushing content to services module (site B).

If user password is hashed by site A using default password.inc, user_hash_password() will not be called.

If user password comes as a clear text, function user_hash_password mush exist, so we need to include password.inc

By the way, if site uses non-default hashing algorithm, hashed password will be rehashed again, breaking user passwords

Instead of using hard-coded pattern for hashed password, we can use (swappable) user_needs_new_hash():

  if (isset($entity->pass) && !preg_match('/^[a-f0-9]{32}$/', $entity->pass)) {
    require_once DRUPAL_ROOT . '/' . variable_get('password_inc', 'includes/password.inc');
    if (user_needs_new_hash($entity)) {
      $entity->pass = user_hash_password($entity->pass);
    }
  }

with exception for md5()-ed D6 passwords.