Fix #440 Hash algo's sometimes skipped for old algorithm support

- Fix check that discards potentially trying all encryption methods if password didn't match
- Wrap call to encryption method properly to avoid calling methods with hasSeparateSalt() = true and a null salt

src/main/java/fr/xephi/authme/security/PasswordSecurity.java

@@ -41,15 +41,8 @@ public class PasswordSecurity {
 
     public boolean comparePassword(String password, HashedPassword hashedPassword, String playerName) {
         EncryptionMethod method = initializeEncryptionMethod(algorithm, playerName);
-        // User is not in data source, so the result will invariably be wrong because an encryption
-        // method with hasSeparateSalt() == true NEEDS the salt to evaluate the password
-        String salt = hashedPassword.getSalt();
-        if (method.hasSeparateSalt() && salt == null) {
-            return false;
-        }
-
         String playerLowerCase = playerName.toLowerCase();
-        return method.comparePassword(password, hashedPassword, playerLowerCase)
+        return methodMatches(method, password, hashedPassword, playerLowerCase)
             || supportOldAlgorithm && compareWithAllEncryptionMethods(password, hashedPassword, playerLowerCase);
     }
 
@@ -69,7 +62,7 @@ public class PasswordSecurity {
         for (HashAlgorithm algorithm : HashAlgorithm.values()) {
             if (!HashAlgorithm.CUSTOM.equals(algorithm)) {
                 EncryptionMethod method = initializeEncryptionMethodWithoutEvent(algorithm);
-                if (method != null && method.comparePassword(password, hashedPassword, playerName)) {
+                if (methodMatches(method, password, hashedPassword, playerName)) {
                     hashPasswordForNewAlgorithm(password, playerName);
                     return true;
                 }
@@ -78,6 +71,22 @@ public class PasswordSecurity {
         return false;
     }
 
+    /**
+     * Verify with the given encryption method whether the password matches the hash after checking that
+     * the method can be called safely with the given data.
+     *
+     * @param method The encryption method to use
+     * @param password The password to check
+     * @param hashedPassword The hash to check against
+     * @param playerName The name of the player
+     * @return True if the password matched, false otherwise
+     */
+    private static boolean methodMatches(EncryptionMethod method, String password,
+                                         HashedPassword hashedPassword, String playerName) {
+        return method != null && (!method.hasSeparateSalt() || hashedPassword.getSalt() != null)
+            && method.comparePassword(password, hashedPassword, playerName);
+    }
+
     /**
      * Get the encryption method from the given {@link HashAlgorithm} value and emit a
      * {@link PasswordEncryptionEvent}. The encryption method from the event is then returned,