19 Sep 2023

Small fix to "suspended" user level. Alternate login methods will also reject suspended users now.

Author: code-boxx

login with google/lib/LIB-GOOIN.php

@@ -54,12 +54,22 @@ function go () {
 
     // (C4) USER HAS ALREADY TIED GOOGLE TO ACCOUNT - LOGIN
     $user = $this->get($guser["id"]);
-    if (is_array($user)) { $this->login($user); }
+    if (is_array($user)) {
+      if ($user["user_level"]=="S") {
+        $this->error = "Invalid user";
+        return;
+      }
+      $this->login($user);
+    }
 
     // (C5) HAS EXISTING ACCOUNT (EMAIL) - TIE TO ACCOUNT & LOGIN
     $this->Core->load("Users");
     $user = $this->Users->get($guser["email"]);
     if (is_array($user)) {
+      if ($user["user_level"]=="S") {
+        $this->error = "Invalid user";
+        return;
+      }
       $this->Users->hashAdd($user["user_id"], "GOO", $guser["id"]);
       $this->login($user);
     }

login with nfc/lib/LIB-NFCIN.php

@@ -45,7 +45,7 @@ function login ($token) {
     // (D2) VERIFY TOKEN
     if ($valid) {
       $user = $this->Users->get($token[0], "NFC");
-      $valid = (is_array($user) && password_verify($token[1], $user["hash_code"]));
+      $valid = (is_array($user) && $user["user_level"]!="S" && password_verify($token[1], $user["hash_code"]));
     }
 
     // (D3) SESSION START

login with webauthn/lib/LIB-WAIN.php

@@ -43,6 +43,10 @@ function getUser ($email) {
       $this->error = "Please register for passwordless login first.";
       return false;
     }
+    if ($user["user_level"]=="S") {
+      $this->error = "Invalid user or password.";
+      return false;
+    }
     $user["hash_code"] = json_decode($user["hash_code"]);
     $user["hash_code"]->credentialId = hex2bin($user["hash_code"]->credentialId);
     $user["hash_code"]->AAGUID = hex2bin($user["hash_code"]->AAGUID);

users/lib/LIB-Users.php

@@ -95,7 +95,7 @@ function del ($id) {
   //  $id : user id
   function suspend ($id) {
     $this->DB->update("users",
-      ["`user_level`=?"], "`user_id`=?",
+      ["user_level"], "`user_id`=?",
       ["S", $id]
     );
   }