Force clients to use different password

[JavierCN]

Hello:

We have installed a passwords expiration system in our WHMCS. We want the clients use a different password when they change it (they're redirected to the recovery page).

Is there any security configuration to active this protection (force to use a different password)?

If not, do you know a hook executed when the client is changing the password on the recovery page?

Thank you ,

Regards.

[steven99]

Do not think that is built in but would be a good feature for that password expiration addon you mentioned.  Would require at least the ClientChangePassword hook.  I do not believe that provides the old password and so you would need another hook, like the ClientAreaPageChangePassword, to capture the old password and store it, still hashed, in the session.  Then on ClientChangePassword, check that session variable against the new password hash.  If it matches, well then you have to force them to password change page via a ClientAreaPage hook and complain that they match. 

[JavierCN]

Great! Thank you @steven99

 

Edited December 27, 2022 by JavierCN