From 60e6410c736ece5e05211f8f1e655e2e96fb71f7 Mon Sep 17 00:00:00 2001
From: Jake Dallimore <jake@moodle.com>
Date: Mon, 1 Dec 2025 13:52:11 +0800
Subject: [PATCH] MDL-87286 enrol_lti: prevent suspended user account auth in
 legacy LTI

---
 enrol/lti/classes/tool_provider.php | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/enrol/lti/classes/tool_provider.php b/enrol/lti/classes/tool_provider.php
index d81ef4baeae..e50966f419d 100644
--- a/enrol/lti/classes/tool_provider.php
+++ b/enrol/lti/classes/tool_provider.php
@@ -259,6 +259,20 @@ class tool_provider extends ToolProvider {
             // Get the updated user record.
             $user = $DB->get_record('user', ['id' => $user->id]);
         } else {
+            if ($dbuser->suspended) {
+                require_once($CFG->libdir . '/authlib.php');
+                $failurereason = AUTH_LOGIN_SUSPENDED;
+                $event = \core\event\user_login_failed::create([
+                    'userid' => $dbuser->id,
+                    'other' => [
+                        'username' => $dbuser->username,
+                        'reason' => $failurereason
+                    ]
+                ]);
+                $event->trigger();
+                throw new \core\exception\moodle_exception('invalidlogin', 'core');
+            }
+
             if (helper::user_match($user, $dbuser)) {
                 $user = $dbuser;
             } else {