From a8ecc443fead76f6499644f263307f74a6492efd Mon Sep 17 00:00:00 2001
From: David Woloszyn <david.woloszyn@moodle.com>
Date: Mon, 8 Sep 2025 14:28:29 +1000
Subject: [PATCH] MDL-86327 auth_webservice: Stricter check on login

---
 auth/webservice/auth.php | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/auth/webservice/auth.php b/auth/webservice/auth.php
index 479b7fd37cd..235ced05dc5 100644
--- a/auth/webservice/auth.php
+++ b/auth/webservice/auth.php
@@ -73,7 +73,15 @@ class auth_plugin_webservice extends auth_plugin_base {
     function user_login_webservice($username, $password) {
         global $CFG, $DB;
         // special web service login
-        if ($user = $DB->get_record('user', array('username'=>$username, 'mnethostid'=>$CFG->mnet_localhost_id))) {
+        $user = $DB->get_record('user', [
+            'username' => $username,
+            'auth' => 'webservice',
+            'deleted' => '0',
+            'suspended' => '0',
+            'mnethostid' => $CFG->mnet_localhost_id,
+        ]);
+
+        if ($user) {
             return validate_internal_user_password($user, $password);
         }
         return false;