L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDL-73396 auth_oauth2: link non-suspended account on oauth login

Browse Source 
Added checks to link non-suspended user accounts to OAuth2, when logging
in. Also added an additional check to prevent users from using OAuth2
to login if their account is suspended in Moodle.
This commit is contained in:
Niko Hoogeveen
2025-12-10 14:21:51 -05:00
parent 307ed32403
commit fb6a0f6444
1 changed files with 42 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
auth/oauth2/classes/auth.php
+42 -14
View File
@@ -467,18 +467,31 @@ class auth extends \auth_plugin_base {
$mappeduser = get_complete_user_data('id', $linkedlogin->get('userid'));
if ($mappeduser && $mappeduser->suspended) {
$failurereason = AUTH_LOGIN_SUSPENDED;
$event = \core\event\user_login_failed::create([
'userid' => $mappeduser->id,
'other' => [
'username' => $userinfo['username'],
'reason' => $failurereason
]
]);
$event->trigger();
$SESSION->loginerrormsg = get_string('invalidlogin');
$client->log_out();
redirect(new moodle_url('/login/index.php'));
// Check if there's another user with the same email that is not suspended.
$moodleuser = \core_user::get_user_by_email($userinfo['email'], '*', null, IGNORE_MULTIPLE);
if ($moodleuser->id == $mappeduser->id) {
$failurereason = AUTH_LOGIN_SUSPENDED;
$event = \core\event\user_login_failed::create([
'userid' => $mappeduser->id,
'other' => [
'username' => $userinfo['username'],
'reason' => $failurereason,
],
]);
$event->trigger();
$SESSION->loginerrormsg = get_string('invalidlogin');
$client->log_out();
redirect(new moodle_url('/login/index.php'));
} else if ($moodleuser && !$moodleuser->suspended) {
// Update the OAuth2 linked login to point to the active user account.
$linkedlogin->set('userid', $moodleuser->id);
$linkedlogin->set('timemodified', time());
$linkedlogin->update();
// Update user fields and continue with login.
$userinfo = $this->update_user($userinfo, $moodleuser);
$userwasmapped = true;
}
} else if ($mappeduser && ($mappeduser->confirmed || !$issuer->get('requireconfirmation'))) {
// Update user fields.
$userinfo = $this->update_user($userinfo, $mappeduser);
@@ -508,7 +521,6 @@ class auth extends \auth_plugin_base {
redirect(new moodle_url('/login/index.php'));
}
if (!$issuer->is_valid_login_domain($oauthemail)) {
// Trigger login failed event.
$failurereason = AUTH_LOGIN_UNAUTHORISED;
@@ -524,8 +536,24 @@ class auth extends \auth_plugin_base {
if (!$userwasmapped) {
// No defined mapping - we need to see if there is an existing account with the same email.
$moodleuser = \core_user::get_user_by_email($userinfo['email'], '*', null, IGNORE_MULTIPLE);
// Ensure we don't link a login for a suspended user.
if (!empty($moodleuser) && $moodleuser->suspended) {
$failurereason = AUTH_LOGIN_SUSPENDED;
$event = \core\event\user_login_failed::create([
'userid' => $moodleuser->id,
'other' => [
'username' => $userinfo['email'],
'reason' => $failurereason,
],
]);
$event->trigger();
$SESSION->loginerrormsg = get_string('invalidlogin');
$client->log_out();
redirect(new moodle_url('/login/index.php'));
}
$moodleuser = \core_user::get_user_by_email($userinfo['email']);
if (!empty($moodleuser)) {
if ($issuer->get('requireconfirmation')) {
$PAGE->set_url('/auth/oauth2/confirm-link-login.php');