From f824f3e5f355d9eb15e957fad96558b3bef9f615 Mon Sep 17 00:00:00 2001
From: Christoph Wurst <christoph@owncloud.com>
Date: Tue, 17 May 2016 10:32:47 +0200
Subject: [PATCH] don't allow token login for disabled users

---
 lib/private/User/Session.php |  4 ++++
 tests/lib/user/session.php   | 32 ++++++++++++++++++++++++++++++++
 2 files changed, 36 insertions(+)

diff --git a/lib/private/User/Session.php b/lib/private/User/Session.php
index 3f074fa8adf8..7104f46fea2f 100644
--- a/lib/private/User/Session.php
+++ b/lib/private/User/Session.php
@@ -362,6 +362,10 @@ private function loginWithToken($uid) {
 			// user does not exist
 			return false;
 		}
+		if (!$user->isEnabled()) {
+			// disabled users can not log in
+			return false;
+		}
 
 		//login
 		$this->setUser($user);
diff --git a/tests/lib/user/session.php b/tests/lib/user/session.php
index 710d5ae20b36..444735b854f0 100644
--- a/tests/lib/user/session.php
+++ b/tests/lib/user/session.php
@@ -477,4 +477,36 @@ public function testActiveUserAfterSetSession() {
 		$this->assertEquals($users['bar'], $userSession->getUser());
 	}
 
+	public function testTryTokenLoginWithDisabledUser() {
+		$manager = $this->getMockBuilder('\OC\User\Manager')
+			->disableOriginalConstructor()
+			->getMock();
+		$session = new Memory('');
+		$token = $this->getMock('\OC\Authentication\Token\IToken');
+		$user = $this->getMock('\OCP\IUser');
+		$userSession = new \OC\User\Session($manager, $session, $this->timeFactory, $this->defaultProvider);
+		$request = $this->getMock('\OCP\IRequest');
+
+		$request->expects($this->once())
+			->method('getHeader')
+			->with('Authorization')
+			->will($this->returnValue('token xxxxx'));
+		$this->defaultProvider->expects($this->once())
+			->method('validateToken')
+			->with('xxxxx')
+			->will($this->returnValue($token));
+		$token->expects($this->once())
+			->method('getUID')
+			->will($this->returnValue('user123'));
+		$manager->expects($this->once())
+			->method('get')
+			->with('user123')
+			->will($this->returnValue($user));
+		$user->expects($this->once())
+			->method('isEnabled')
+			->will($this->returnValue(false));
+
+		$this->assertFalse($userSession->tryTokenLogin($request));
+	}
+
 }