Password Expiry permits reusing current password as new password

[Eliot Sykes]

Password expiry allows a user with an expired password to reuse their current password as their new password.

[Eliot Sykes]

You can setup the password_archiveable module as a workaround for this bug. This prevented the current password from being set as the new password with the following settings in the initializer:

  # How many passwords to keep in archive
  config.password_archiving_count = 4

  # Deny old password (true, false, count)
  config.deny_old_passwords = true

[Mario Manno]

Thanks for bringing this up. Using both modules together is the expected way to implement password expiry without password reuse. If this was not clear from the README.md we need to update the documentation.

[Eliot Sykes]

Thanks @manno - documented in #177

[Mathieu Jobin]

this new feature also allow to prevent the reuse of all previous password newer than a X date.

#174