[PR #4837] [CLOSED] Added password history, complexity, and expiry validations #6414

New Issue

OVERLORD · 2026-02-05T10:31:38+03:00

OVERLORD commented

2026-02-05 10:31:38 +03:00

📋 Pull Request Information

Original PR: https://github.com/BookStackApp/BookStack/pull/4837
Author: @bosaleh
Created: 2/12/2024
Status: ❌ Closed

Base: development ← Head: development

📝 Commits (4)

6cb7c1c add password history, complexity, and expiry validations
2e76258 added translations for password history errors
9672d79 fixed dependencies
9a41c1b added useful comments

📊 Changes

10 files changed (+187 additions, -2 deletions)

View changed files

📝 .env.example.complete (+21 -0)
📝 app/Access/Controllers/LoginController.php (+9 -0)
📝 app/Access/Controllers/ResetPasswordController.php (+10 -1)
📝 app/Access/Controllers/UserInviteController.php (+8 -0)
📝 app/App/Providers/AuthServiceProvider.php (+9 -1)
➕ app/Exceptions/PasswordHistoryException.php (+7 -0)
➕ app/Users/Models/PasswordHistory.php (+62 -0)
📝 app/Users/UserRepo.php (+9 -0)
➕ database/migrations/2024_01_28_112712_create_password_histories_table.php (+46 -0)
📝 lang/en/errors.php (+6 -0)

📄 Description

This PR implements the following validations for passwords:

1- Password history: stops the user from re-using a password they have previously used. The number of passwords to be validated can be set in the PASSWORD_HISTORY environment variable.

2- Password expiry: forces the user to reset their password after a specified period. The number of days before expiry can be set in the PASSWORD_MAX_AGE environment variable.

3- Password lock: Stops the password from being changed until a specified period has elapsed. The number of days until a password can be changed can be set in the PASSWORD_MIN_AGE environment variable.

4- Password complexity: uses Laravel's built-in password validation to enforce password policies that can be set as environment variables. Please see .env.example.complete for the complete list of complexity validations.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/BookStackApp/BookStack/pull/4837 **Author:** [@bosaleh](https://github.com/bosaleh) **Created:** 2/12/2024 **Status:** ❌ Closed **Base:** `development` ← **Head:** `development` --- ### 📝 Commits (4) - [`6cb7c1c`](https://github.com/BookStackApp/BookStack/commit/6cb7c1cb33ed2cea211eb554d3a73b70824c6dd1) add password history, complexity, and expiry validations - [`2e76258`](https://github.com/BookStackApp/BookStack/commit/2e762586b671fec87c085b3a909621403d5ec2a6) added translations for password history errors - [`9672d79`](https://github.com/BookStackApp/BookStack/commit/9672d79a2dc6159b96a09d2082f0b091ceb1ced2) fixed dependencies - [`9a41c1b`](https://github.com/BookStackApp/BookStack/commit/9a41c1bd506d63d60c0229391c2bdfe9b234b749) added useful comments ### 📊 Changes **10 files changed** (+187 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `.env.example.complete` (+21 -0) 📝 `app/Access/Controllers/LoginController.php` (+9 -0) 📝 `app/Access/Controllers/ResetPasswordController.php` (+10 -1) 📝 `app/Access/Controllers/UserInviteController.php` (+8 -0) 📝 `app/App/Providers/AuthServiceProvider.php` (+9 -1) ➕ `app/Exceptions/PasswordHistoryException.php` (+7 -0) ➕ `app/Users/Models/PasswordHistory.php` (+62 -0) 📝 `app/Users/UserRepo.php` (+9 -0) ➕ `database/migrations/2024_01_28_112712_create_password_histories_table.php` (+46 -0) 📝 `lang/en/errors.php` (+6 -0) </details> ### 📄 Description This PR implements the following validations for passwords: 1- Password history: stops the user from re-using a password they have previously used. The number of passwords to be validated can be set in the PASSWORD_HISTORY environment variable. 2- Password expiry: forces the user to reset their password after a specified period. The number of days before expiry can be set in the PASSWORD_MAX_AGE environment variable. 3- Password lock: Stops the password from being changed until a specified period has elapsed. The number of days until a password can be changed can be set in the PASSWORD_MIN_AGE environment variable. 4- Password complexity: uses Laravel's built-in password validation to enforce password policies that can be set as environment variables. Please see .env.example.complete for the complete list of complexity validations. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

OVERLORD added the pull-request label 2026-02-05 10:31:38 +03:00

OVERLORD closed this issue

2026-02-05 10:31:42 +03:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/BookStack#6414