MDL-90 authenticate_user_login() - don't accidentally return a bogus $user

While I don't quite understand why we need that $user->id=0, at
_least_ make double sure we don't return it! Callers assume
that if we return an object===success and a user acct that just does
not exist will return an dummy object.

diff --git a/lib/moodlelib.php b/lib/moodlelib.php
index ab0cd992cb50708e9fd7a5eebe8e14e6236c554c..66c37bff8127d8823f22bd298f4bfa150b9a1ec8 100644 (file)
--- a/lib/moodlelib.php
+++ b/lib/moodlelib.php
@@ -3059,8 +3059,10 @@ function authenticate_user_login($username, $password) {
             }
         }
 
+        if ($user->id===0) {
+            return false;
+        }
         return $user;
-
     }
 
     // failed if all the plugins have failed