开发用户审批插件：阻止user_status=0的用户登录并添加错误提示

Hey there! Great question—this is a super common scenario for user approval workflows, and leveraging your existing user_status field is a smart, clean approach. Let’s break down exactly how to make this work:

1. Intercept Login Validation Before Session Creation #

Right after you confirm the user’s username and password are correct (don’t skip credential checks first!), pull their user_status value from your database. If it’s set to 0, you’ll halt the session setup and redirect back to the login page with an error.

Here’s a concrete example using vanilla PHP (adjust this to match your tech stack if needed):

// Start session first (critical for storing error messages)
session_start();

// Assume you've already validated the user's password matches what's in the DB
$user = get_user_by_username($_POST['username']); // Your custom function to fetch user data

if ($user['user_status'] === 0) {
    // Kill any partial session that might have started
    if (session_id()) {
        session_destroy();
    }
    // Store a clear error message for the login page
    $_SESSION['login_error'] = "Your account is pending approval. Please wait for an admin to review your request.";
    // Redirect back to login form
    header("Location: login.php");
    exit();
} else {
    // Proceed to create a valid session for approved users
    $_SESSION['user_id'] = $user['id'];
    $_SESSION['username'] = $user['username'];
    // Send them to your app's main page
    header("Location: dashboard.php");
    exit();
}

2. Display the Error Message on the Login Page #

Now, update your login form to check for the error message and display it to the user. This makes sure they know exactly why their login failed.

Example HTML/PHP snippet for your login page:

<?php session_start(); ?>

<!-- Display error if it exists -->
<?php if (isset($_SESSION['login_error'])): ?>
    <div style="color: red; padding: 10px; border: 1px solid red; margin-bottom: 15px;">
        <?php echo $_SESSION['login_error']; ?>
        <?php unset($_SESSION['login_error']); // Clear the error after showing it ?>
    </div>
<?php endif; ?>

<!-- Your login form -->
<form method="POST" action="login_process.php">
    <label for="username">Username:</label>
    <input type="text" id="username" name="username" required>
    
    <label for="password">Password:</label>
    <input type="password" id="password" name="password" required>
    
    <button type="submit">Log In</button>
</form>

3. Framework-Specific Adjustments (If Applicable) #

If you’re using a web framework like Laravel, Symfony, or Django, the core logic stays the same—but you’ll use built-in auth hooks instead of vanilla code:

• Laravel: Override the authenticate method in your LoginController to check user_status before logging the user in, or use a Login event listener.
• Django: Add a custom authentication backend that checks the user’s status, or use a signal during the login process.
• Symfony: Use an event subscriber for the security.authentication.success event to block unapproved users.

Quick Security Note #

If you’re worried about user enumeration attacks (where attackers guess valid usernames by checking error messages), you can opt for a more generic error like "Invalid credentials or account pending approval" instead of specifying the approval status. It’s a tradeoff between clarity and security—pick what makes sense for your app.

That’s all you need! This setup will block unapproved users from creating sessions, give them clear feedback, and work seamlessly with your existing user_status field.

内容的提问来源于stack exchange，提问作者Mouner Mostafa