Checkes if current password hasn't been used before.
This is the 'unusedNewPassword' validator as declared in rules().
@return boolean
173610
public function unusedNewPassword()
    {
        if ($this->hasErrors()) {
            return false;
        }

        /** @var IdentityInterface */
        $identity = $this->getIdentity();
        // check if new password hasn't been used before
        if ($identity instanceof PasswordHistoryIdentityInterface) {
            if (($lastUsed = $identity->getPasswordDate($this->newPassword)) !== null) {
                $this->addError('newPassword', Yii::t('usr', 'New password has been used before, last set on {date}.', ['date' => $lastUsed]));

                return false;
            }

            return true;
        }
        // check if new password is not the same as current one
        if (property_exists($this, 'password')) {
            if ($this->password === $this->newPassword) {
                $this->addError('newPassword', Yii::t('usr', 'New password must be different than the old one.'));

                return false;
            }
        }

        return true;
    }
1146025
public function getPasswordAge()
    {
        $date = \MUtil_Date::ifDate(
                $this->_getVar('user_password_last_changed'),
                array(\Gems_Tracker::DB_DATETIME_FORMAT, \Gems_Tracker::DB_DATE_FORMAT, \Zend_Date::ISO_8601)
                );
        if ($date instanceof \MUtil_Date) {
            return abs($date->diffDays());
        } else {
            return 0;
        }
    }
924494
public function updatePassword()
    {
        $sNewPass = \OxidEsales\Eshop\Core\Registry::getConfig()->getRequestParameter('password_new', true);
        $sConfPass = \OxidEsales\Eshop\Core\Registry::getConfig()->getRequestParameter('password_new_confirm', true);

        $oUser = oxNew(\OxidEsales\Eshop\Application\Model\User::class);

        /** @var \OxidEsales\Eshop\Core\InputValidator $oInputValidator */
        $oInputValidator = \OxidEsales\Eshop\Core\Registry::getInputValidator();
        if (($oExcp = $oInputValidator->checkPassword($oUser, $sNewPass, $sConfPass, true))) {
            return \OxidEsales\Eshop\Core\Registry::getUtilsView()->addErrorToDisplay($oExcp->getMessage(), false, true);
        }

        // passwords are fine - updating and loggin user in
        if ($oUser->loadUserByUpdateId($this->getUpdateId())) {
            // setting new pass ..
            $oUser->setPassword($sNewPass);

            // resetting update pass params
            $oUser->setUpdateKey(true);

            // saving ..
            $oUser->save();

            // forcing user login
            \OxidEsales\Eshop\Core\Registry::getSession()->setVariable('usr', $oUser->getId());

            return 'forgotpwd?success=1';
        } else {
            // expired reminder
            $oUtilsView = \OxidEsales\Eshop\Core\Registry::getUtilsView();

            return $oUtilsView->addErrorToDisplay('ERROR_MESSAGE_PASSWORD_LINK_EXPIRED', false, true);
        }
    }
1263557
public function checkPassword(): bool
    {
        if (!isset($this->regex)) {
            return true;
        }

        return filter_var($this->password, FILTER_VALIDATE_REGEXP, [
            'options' => [
                'regexp' => $this->regex
            ]
        ]);
    }
727435
public function getOldPasswordElement()
    {
        $element = $this->getElement($this->_oldPasswordFieldName);

        if (! $element) {
            // Field current password
            $element = new \Zend_Form_Element_Password($this->_oldPasswordFieldName);
            $element->setLabel($this->_('Current password'));
            $element->setAttrib('size', 40);
            $element->setRenderPassword(true);
            $element->setRequired(true);
            $element->addValidator(
                    new \Gems_User_Validate_UserPasswordValidator($this->user, $this->_('Wrong password.'))
                    );

            $this->addElement($element);
        }

        return $element;
    }
1120131
public function checkLastPasswords(string $value, array $context): bool
    {
        // return true if config is not set
        if (empty($this->getConfig('oldPasswordCount'))) {
            return true;
        }

        // ignore on new user
        if (empty($context['data']['id'])) {
            return true;
        }
        $user = $this->_table->get($context['data']['id']);

        if (is_array($user->last_passwords)) {
            foreach ($user->last_passwords as $oldPasswordHash) {
                if ((new DefaultPasswordHasher)->check($value, $oldPasswordHash)) {
                    return false;
                }
            }
        }

        return true;
    }
39675
public function registerValidators()
    {
        Validator::extend('oldPassword', function ($attribute, $value, $parameters) {

            $checkOldPassword = Auth::attempt(['id' => Auth::user()->id, 'password' => $value]);

            if (!$checkOldPassword) {
                return false;
            }

            return true;

        }, 'The old password is incorrect.');
    }
618214
protected function getOneTimePassword()
    {
        if (is_null($password = $this->getInputOneTimePassword()) || empty($password)) {
            event(new EmptyOneTimePasswordReceived());

            if ($this->config('throw_exceptions', true)) {
                throw new InvalidOneTimePassword('One Time Password cannot be empty.');
            }
        }

        return $password;
    }
178091
protected function checkRequired()
    {
        $errors = new Exceptions();
        foreach ($this->getRequiredKeys() as $required) {
            if (!isset($this->$required)) {
                $errors->add(new Exception('Required property "' . $required . '" is missing'));
            }
        }
        if (!$errors->empty()) {
            throw $errors;
        }
        return true;
    }
1208040
protected function saveData()
    {
        // If form is valid, but contains messages, do show them. Most likely these are the not enforced password rules
        if ($this->_form->getMessages()) {
            $this->addMessage($this->_form->getMessages());
        }
        $this->addMessage($this->_('New password is active.'));

        // If the password is valid (for the form) then it is saved by the form itself.
        return 1;
    }
1317781
protected function validatePasswordUser()
    {
        $field = 'password';

        if ($this->isExcluded($field)) {
            return null;
        }

        $value = $this->getSubmitted($field);

        if ($this->isUpdating() && (!isset($value) || $value === '')) {
            return null;
        }

        if (empty($value)) {
            $this->setErrorRequired($field, $this->translation->text('Password'));
            return false;
        }

        return true;
    }
797556
public function isRemoteCheckRequired()
    {
        if ($this->uid && $this->sessionToken && $this->recheck) {
            if($this->recheck > (new DateTime('NOW'))) {
                return false;
            }
        }

        return true;
    }
436329
public function resetPassword()
    {
        $user = $this->_user;
        $user->setPassword($this->password);
        $user->removePasswordResetToken();
        Event::off(BaseActiveRecord::className(), BaseActiveRecord::EVENT_AFTER_UPDATE);

        return $user->save(false);
    }
401442
private function getPassword()
    {
        $password = $this->secret("Enter your password");
        $passwordAgain = $this->secret("Enter your password again");

        $validator = Validator::make([
            'password'              => $password,
            'password_confirmation' => $passwordAgain,
        ], [
            'password' => 'required|min:5|confirmed',
        ]);

        if( $validator->fails() ) {
            $this->info('');
            $this->error("The password must be at least 5 characters and must match!");
            $this->info('');

            return $this->getPassword();
        }

        $this->password = bcrypt($password);
    }
1181224
protected function validatePasswordLengthUser()
    {
        $field = 'password';

        if ($this->isExcluded($field) || $this->isError($field)) {
            return null;
        }

        $value = $this->getSubmitted($field);

        if ($this->isUpdating() && (!isset($value) || $value === '')) {
            return null;
        }

        $length = mb_strlen($value);
        list($min, $max) = $this->user->getPasswordLength();

        if ($length < $min || $length > $max) {
            $this->setErrorLengthRange($field, $this->translation->text('Password'), $min, $max);
            return false;
        }

        return true;
    }
844840
public function resetPassword()
    {
        $identity = $this->getIdentity();
        if (($message = $identity->resetPassword($this->newPassword)) !== true) {
            $this->addError('newPassword', is_string($message) ? $message : Yii::t('usr', 'Failed to reset the password.'));

            return false;
        }

        return true;
    }
316143
protected function validationOldPassword($validator) {
		$validator->setProvider('userBehavior', $this);
		$validator->setProvider('userTable', $this->_table);

		$validator->add('old_password', 'notBlank', [
			'rule' => 'notBlank',
			'message' => __d('user_tools', 'Enter your old password.')
		]);
		$validator->add('old_password', 'oldPassword', [
			'rule' => ['validateOldPassword', 'password'],
			'provider' => 'userBehavior',
			'message' => __d('user_tools', 'Wrong password, please try again.')
		]);

		return $validator;
	}