MDL-19269 Deleted internal auth users - handling is buggy; credit Martin Langhoff

diff --git a/lib/moodlelib.php b/lib/moodlelib.php
index d9f88423156404688c44a3b74b810b3d65ed56ff..013273660e1728e2df17cb7ad9c609eb04086cfa 100644 (file)
--- a/lib/moodlelib.php
+++ b/lib/moodlelib.php
@@ -3493,14 +3493,15 @@ function authenticate_user_login($username, $password) {
             error_log('[client '.getremoteaddr()."]  $CFG->wwwroot  Disabled Login:  $username  ".$_SERVER['HTTP_USER_AGENT']);
             return false;
         }
-        if (!empty($user->deleted)) {
-            add_to_log(0, 'login', 'error', 'index.php', $username);
-            error_log('[client '.getremoteaddr()."]  $CFG->wwwroot  Deleted Login:  $username  ".$_SERVER['HTTP_USER_AGENT']);
-            return false;
-        }
         $auths = array($auth);
 
     } else {
+        // check if there's a deleted record (cheaply)
+        if ($DB->get_field('user', 'id', array('username'=>$username, 'deleted'=>1))) {
+            error_log('[client '.$_SERVER['REMOTE_ADDR']."]  $CFG->wwwroot  Deleted Login:  $username  ".$_SERVER['HTTP_USER_AGENT']);
+            return false;
+        }
+
         $auths = $authsenabled;
         $user = new object();
         $user->id = 0;     // User does not exist