+ get_setting( 'enabled' ) ) && apply_filters( 'tenup_experience_enable_password_policy', true );
+ }
+
+}
diff --git a/includes/classes/Authentication/PastPasswords.php b/includes/classes/Authentication/PastPasswords.php
new file mode 100644
index 0000000..8300fe7
--- /dev/null
+++ b/includes/classes/Authentication/PastPasswords.php
@@ -0,0 +1,293 @@
+format( 'Y-m-d' ) . ' 1:00:00' ); // Run at 1AM everyday.
+ $time->modify( '+1 day' );
+ wp_schedule_event( $time->getTimestamp(), 'daily', 'tenup_notify_expired_passwords' );
+ }
+ }
+
+ /**
+ * If the current users profile update includes changing their password
+ * let's confirm that their new password does not match the current
+ * or past passwords.
+ *
+ * @param WP_Error $errors Errors object to add any custom errors to
+ * @param boolean|int $update true if updating an existing user, false if saving a new user
+ * @param object $user User object for user being edited
+ */
+ public function update_profile( $errors, $update, $user ) {
+ $new_password = filter_input( INPUT_POST, 'pass1', FILTER_SANITIZE_STRING );
+ $new_password_confirm = filter_input( INPUT_POST, 'pass2', FILTER_SANITIZE_STRING );
+ if ( $update && ! empty( $new_password ) && $new_password === $new_password_confirm ) {
+
+ $this->validate_password_reset( $errors, $user );
+
+ if ( empty( $errors->get_error_codes() ) ) {
+ $this->save_current_password( $user );
+ }
+ }
+ }
+
+ /**
+ * Confirm that the password being used in a reset does not match the
+ * existing or past passwords.
+ *
+ * @param WP_Error $errors Errors object to add any custom errors to
+ * @param object $user User object for user being edited
+ */
+ public function validate_password_reset( $errors, $user ) {
+ $new_password = filter_input( INPUT_POST, 'pass1', FILTER_SANITIZE_STRING );
+ $new_password_confirm = filter_input( INPUT_POST, 'pass2', FILTER_SANITIZE_STRING );
+ $max_password = (int) PasswordPolicy::instance()->get_setting( 'past_passwords' );
+ $user = get_userdata($user->ID );
+
+ if ( $max_password > 0 && ! empty( $new_password ) && $new_password === $new_password_confirm && is_array( $user->roles ) && ! empty( array_intersect( $user->roles, $this->get_password_expire_roles() ) ) ) {
+ if ( $this->invalid_duplicate( $user, $new_password ) ) {
+ $errors->add( 'duplicate_password', __( 'This password has previously been used, you must select a unique password', 'tenup' ) );
+ }
+ }
+ }
+
+ /**
+ * Store the users existing password before resetting their password.
+ *
+ * @param object $user User object for user being edited
+ * @param string $new_password New password
+ */
+ public function password_reset( $user, $new_password ) {
+ $this->save_current_password( $user );
+ }
+
+ /**
+ * Check to see if the new password does not match the users existing
+ * password or one of their previous ones.
+ *
+ * @param object $user User object for user being edited
+ * @param string $new_password New password
+ *
+ * @return bool
+ */
+ private function invalid_duplicate( $user, $new_password ) {
+
+ $is_invalid = false;
+ $old_passwords = (array) get_user_meta( $user->ID, self::METAKEY_PASSWORD, true );
+ $old_passwords[] = $this->get_current_password( $user );
+
+ foreach ( $old_passwords as $old_password ) {
+ if ( wp_check_password( $new_password, $old_password, $user->ID ) ) {
+ $is_invalid = true;
+ break;
+ }
+ }
+
+ return $is_invalid;
+ }
+
+ /**
+ * Save the current users password to meta so we can use it
+ * in the future to make sure they are not using an existing password
+ *
+ * @param object $user User object for user being edited
+ */
+ private function save_current_password( $user ) {
+ if ( is_object( $user ) && is_array( $user->roles ) && ! empty( array_intersect( $user->roles, $this->get_password_expire_roles() ) ) ) {
+ $max_password = (int) PasswordPolicy::instance()->get_setting( 'past_passwords' );
+
+ // only save past passwords if the pass password setting is greater than 1
+ if( $max_password > 0 ) {
+ $old_passwords = (array) get_user_meta( $user->ID, self::METAKEY_PASSWORD, true );
+
+ $old_passwords[] = $this->get_current_password( $user );
+ $old_passwords = array_filter( $old_passwords );
+ $old_password_count = count( $old_passwords );
+
+ // Limit the old password based on the password policy setting
+ if ( $old_password_count > $max_password ) {
+ array_splice( $old_passwords, $old_password_count - $max_password );
+ }
+
+ update_user_meta( $user->ID, self::METAKEY_PASSWORD, $old_passwords );
+ update_user_meta( $user->ID, self::METAKEY_PASSWORD_EXPIRE, current_datetime()->format( 'Y-m-d' ) );
+ }
+
+ }
+ }
+
+ /**
+ * Prevent users from authenticating if their current password is expired
+ *
+ * @param WP_User $user User object
+ * @param string $password current password
+ *
+ * @return \WP_User|\WP_Error
+ */
+ public function prevent_login_for_expired_passwords( $user, $password ) {
+ $last_updated_password = get_user_meta( $user->ID, self::METAKEY_PASSWORD_EXPIRE, true );
+ $password_expiration = $this->get_password_expired_date();
+ $days_password_is_good_for = (int) PasswordPolicy::instance()->get_setting( 'expires' );
+
+ if ( $days_password_is_good_for > 0 && ( empty( $last_updated_password ) || $password_expiration > $last_updated_password ) && is_array( $user->roles ) && ! empty( array_intersect( $user->roles, $this->get_password_expire_roles() ) ) ) {
+ return new \WP_Error(
+ 'Password Expired',
+ // translators: URL to the reset password screen
+ sprintf( __( 'Your password has expired please reset your password.', 'tenup' ), esc_url( wp_lostpassword_url() ) )
+ );
+ }
+
+ return $user;
+ }
+
+ /**
+ * Notify all users that have an expired password
+ *
+ * @return void
+ */
+ public function notify_expired_passwords() {
+ $reminder_days = (int) PasswordPolicy::instance()->get_setting( 'reminder' );
+
+ // reminder days needs to be greater than 1 to run
+ if( $reminder_days < 1 ){
+ return;
+ }
+
+ $users = new \WP_User_Query(
+ array(
+ 'role__in' => $this->get_password_expire_roles(),
+ 'meta_query' => array(
+ array(
+ 'key' => self::METAKEY_PASSWORD_EXPIRE,
+ 'value' => $this->get_password_reminder_date(),
+ 'compare' => '=',
+ ),
+ ),
+ 'number' => apply_filters( 'tenup_number_user_query', 250 ),
+ 'field' => array( 'user_email', 'user_login' ),
+ )
+ );
+
+ if ( ! empty( $users->get_results() ) ) {
+ $blog_name = wp_specialchars_decode( get_option( 'blogname' ), ENT_QUOTES );
+ $expiration_text = current_datetime()->modify( "+$reminder_days day" )->format( 'F dS, Y' );
+ $message = PasswordPolicy::instance()->get_setting( 'reminder_email' );
+ $message .= sprintf( '
%s
', esc_html__( 'To reset your password, visit the following address:', 'tenup' ) );
+ // translators: %1$s is the URL to the reset password screen
+ $message .= sprintf( '