From 5849684b92cd68b50898b841a6324a55997b1736 Mon Sep 17 00:00:00 2001
From: Vincent Vanwaelscappel <vincent@cubedesigners.com>
Date: Fri, 21 Apr 2023 19:55:48 +0200
Subject: [PATCH] wip #5873 @0.25

---
 src/app/Models/User.php                 | 14 ++++++++++++++
 src/app/Operations/LoginasOperation.php |  5 ++---
 2 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/src/app/Models/User.php b/src/app/Models/User.php
index 516e3d8..fa41660 100644
--- a/src/app/Models/User.php
+++ b/src/app/Models/User.php
@@ -221,6 +221,20 @@ class User extends CubistMagicAuthenticatable implements HasLocalePreference
         return isset(self::$_companyNames[$id]) ? self::$_companyNames[$id] : $id;
     }
 
+    public function isDisabled()
+    {
+        return parent::isDisabled() || $this->isCompanyAccessDisabled();
+    }
+
+    protected function isCompanyAccessDisabled()
+    {
+        $company = Company::find($this->company);
+        if (null === $company || !$company->toolbox_access) {
+            return true;
+        }
+        return false;
+    }
+
     public function getManagedUsers()
     {
         if (null === $this->_managedUsers) {
diff --git a/src/app/Operations/LoginasOperation.php b/src/app/Operations/LoginasOperation.php
index baaa820..2953264 100644
--- a/src/app/Operations/LoginasOperation.php
+++ b/src/app/Operations/LoginasOperation.php
@@ -22,12 +22,11 @@ trait LoginasOperation
     {
         set_time_limit(0);
         /** @var User $user */
-        $user = User::where('id', $id)->where('enabled', '1')->first();
+        $user = User::where('id', $id)->first();
         if (null === $user) {
             abort(404);
         }
-        $company = Company::find($user->company);
-        if (null === $company || !$company->toolbox_access) {
+        if($user->isDisabled()){
             abort(404);
         }
         if (!$this->canLoginas($user)) {
-- 
2.39.5