Fix for disabled logged-in users (#6612)

fix https://github.com/FreshRSS/FreshRSS/issues/6611
Logged-in users were still able to use their account for some time despite having being disabled by admin

1 files changed, 9 insertions, 8 deletions

diff --git a/app/Models/Auth.php b/app/Models/Auth.php
index ecb8ead2f..416f3061d 100644
--- a/app/Models/Auth.php
+++ b/app/Models/Auth.php
@@ -31,15 +31,16 @@ class FreshRSS_Auth {
 			]);
 		}
 
-		if (self::$login_ok) {
-			self::giveAccess();
-		} elseif (self::accessControl() && self::giveAccess()) {
+		if (self::$login_ok && self::giveAccess()) {
+			return self::$login_ok;
+		}
+		if (self::accessControl() && self::giveAccess()) {
 			FreshRSS_UserDAO::touch();
-		} else {
-			// Be sure all accesses are removed!
-			self::removeAccess();
+			return self::$login_ok;
 		}
-		return self::$login_ok;
+		// Be sure all accesses are removed!
+		self::removeAccess();
+		return false;
 	}
 
 	/**
@@ -103,7 +104,7 @@ class FreshRSS_Auth {
 	 */
 	public static function giveAccess(): bool {
 		FreshRSS_Context::initUser();
-		if (!FreshRSS_Context::hasUserConf()) {
+		if (!FreshRSS_Context::hasUserConf() || !FreshRSS_Context::userConf()->enabled) {
 			self::$login_ok = false;
 			return false;
 		}