From 57a816a1a6a895515b5d0a23db86861df3c2e333 Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Thu, 23 Sep 2021 11:19:02 +0200 Subject: Don't further setup disabled users when logging in with apache Signed-off-by: Joas Schilling --- lib/private/legacy/OC_User.php | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'lib') diff --git a/lib/private/legacy/OC_User.php b/lib/private/legacy/OC_User.php index f955c5c6938..848f460dac5 100644 --- a/lib/private/legacy/OC_User.php +++ b/lib/private/legacy/OC_User.php @@ -35,6 +35,8 @@ * along with this program. If not, see * */ + +use OC\User\LoginException; use OCP\EventDispatcher\IEventDispatcher; use OCP\ILogger; use OCP\IUserManager; @@ -170,6 +172,10 @@ class OC_User { if (self::getUser() !== $uid) { self::setUserId($uid); $userSession = \OC::$server->getUserSession(); + if ($userSession->getUser() && !$userSession->getUser()->isEnabled()) { + $message = \OC::$server->getL10N('lib')->t('User disabled'); + throw new LoginException($message); + } $userSession->setLoginName($uid); $request = OC::$server->getRequest(); $userSession->createSessionToken($request, $uid, $uid); -- cgit v1.2.3