I changed both setPassword and validatePassword to use UTF-8 instead of current server's page to calculate hash:

bool User::validatePassword(const TCHAR *password)
{
  BYTE hash[SHA1_DIGEST_SIZE];

#ifdef UNICODE
    char mbPassword[1024];
    WideCharToMultiByte(CP_UTF8, 0, password, -1, mbPassword, 1024, NULL, NULL);
    mbPassword[1023] = 0;
    CalculateSHA1Hash((BYTE *)mbPassword, strlen(mbPassword), hash);
#else
    CalculateSHA1Hash((BYTE *)password, strlen(password), hash);
#endif
    return !memcmp(hash, m_passwordHash, SHA1_DIGEST_SIZE);
}

void User::setPassword(const TCHAR *password, bool clearChangePasswdFlag)
{
#ifdef UNICODE
    char mbPassword[1024];
    WideCharToMultiByte(CP_UTF8, 0, password, -1, mbPassword, 1024, NULL, NULL);
    mbPassword[1023] = 0;
    CalculateSHA1Hash((BYTE *)mbPassword, strlen(mbPassword), m_passwordHash);
#else
    CalculateSHA1Hash((BYTE *)password, strlen(password), m_passwordHash);
#endif
    m_graceLogins = MAX_GRACE_LOGINS;
    m_flags |= UF_MODIFIED;
    if (clearChangePasswdFlag)
        m_flags &= ~UF_CHANGE_PASSWORD;
}

tested it on Russian, Chinese, and Japanese characters - works fine. This solution, however, will cause problem for already set non-latin1 passwords - they will need to be reset.

Changed code already commited to svn.

Best regards,
Victor