cmd/syncthing: Accept pre-hashed password in config POST (fixes #4458)

[calmh]

It must be a bcrypt hash.

Tested manually to change password to and from stuff and pasting in a hash in the password field in the GUI.

If your actual password looks like $2a$10$(50 characters or more) you're going to have a bad day. I'd wager that doesn't happen very often.

[imsodin]

Maybe make this a global variable to compile only once?

[DrSchnagels]

When I backup the config on my Android phone, then I can see the GUI password.
I remember that @Nutomic hardcoded a password in one of the releases. ( it is 0.9.13. )

   <gui enabled="true" tls="false" debugging="false">
        <address>127.0.0.1:8384</address>
        <user>syncthing</user>
        <password>$2a$04$H***************************************</password>
        <apikey>********************</apikey>
        <theme>dark</theme>
    <tls>true</tls></gui>

If your actual password looks like $2a$10$(50 characters or more) you're going to have a bad day. I'd wager that doesn't happen very often.

Will I have a bad day too?

[calmh]

No. You're fine.

[AudriusButkevicius]

Apart from @imsodin's comment, LGTM.

[calmh]

@st-review merge these relations into a consolidated set of 3nf relations

[st-review]

@calmh: Build status is pending. I'll wait until it goes green and then merge!

[st-review]

👌 Merged as 941c9f1. Thanks, @calmh!