From 413618749cb86e828d108a0a34c6360865bcbb9b Mon Sep 17 00:00:00 2001
From: Andrew McMillan <andrew@morphoss.com>
Date: Sat, 27 Nov 2010 16:42:22 +1300
Subject: [PATCH] Be pedantic about checking user is active before we let them
 in.

---
 inc/HTTPAuthSession.php | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/inc/HTTPAuthSession.php b/inc/HTTPAuthSession.php
index bcc770b0..e0b3fcaf 100644
--- a/inc/HTTPAuthSession.php
+++ b/inc/HTTPAuthSession.php
@@ -121,8 +121,14 @@ class HTTPAuthSession {
     */
     if ( isset($_SERVER['PHP_AUTH_USER']) ) {
       if ( $u = $this->CheckPassword( $_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW'] ) ) {
-        $this->AssignSessionDetails($u);
-        return;
+        /**
+         * Maybe some external authentication didn't return false for an inactive
+         * user, so we'll be pedantic here. 
+         */
+        if ( $u->active ) {
+          $this->AssignSessionDetails($u);
+          return;
+        }
       }
     }
 
@@ -227,7 +233,8 @@ class HTTPAuthSession {
        */
       if (isset($c->authenticate_hook['optional']) && $c->authenticate_hook['optional']) {
         if ($hook_response !== false) { return $hook_response; }
-      } else {
+      }
+      else {
         return $hook_response;
       }
     }