joomla/joomla-cms — pull request #3129 by mbabker (2014-02-17 04:06:21+00:00)
Title: Disallow reuse of the current password when the user is changing their password

# Overview

**IMPORTANT**: Please see Joomla! Tracker item [TODO](http://joomlacode.org/gf/project/joomla/tracker/?action=TrackerItemEdit&tracker_item_id=TODO)

In the core CMS, currently there is no check to see if a user is reusing their current password when resetting it (either voluntarily or via the remind/reset feature), which allows users to use the same password repeatedly. This pull request implements a check into the save methods to check for password reuse and disallows it. Note that no option is included to disable this check; if this PR is accepted, without hacking the core code or bypassing its use, users will be required to use different passwords when they are changed.

This check utilizes the current hashing API, `JUserHelper::verifyPassword()` to perform this check by comparing the new clear text password against the existing hashed password (which is the same logic used in the login system).

# Test instructions

To test this feature, you will need to apply the patch. Once applied, login to the admin section and attempt to change your password in either the User Manager or by editing your profile using the shortcut in the top menu by using your current password; the save operation should fail with a message detailing why. Now using a different password, attempt to save again; the operation should succeed. Now make another change without changing the password; the operation should succeed.

Now log into the front end and edit the user profile. Again, attempt to change your password and reuse the existing password; the save should fail with a message explaining why. Now use a different password and the save should succeed. Lastly, make another change to the profile without changing the password; the operation should succeed.

# Project management information

## Backwards compatibility

Within the API, there is no B/C break with this patch.

## Developer information

N/A; no API changes are made with this patch.

## Language changes

This PR adds language strings to convey the added check in updating the user profile.