Attempt to log in when deleted updates lastlogin field

[Richard Mansfield]

When a deleted user attempts to log in, the lastlogin field is updated, but it shouldn't be.

[Robert Lyon (robertl-9)]

This does not look to be happening for a deleted user anymore. It does, however, happen for a suspended user.

The problem is the ./htdocs/auth/user.php has an authenticate() function that saves the new 'lastlogin' value and it is called before the check to see if one is suspended. If we swap this around it should sort the problem.

But then comes the question: Do we want the database to reflect the last legitimate login or the last time they tried to to login?

[Kristina Hoeppner (kris-hoeppner)]

I would say the last login was when they could actually get into their account and do something there, i.e. the legitimate login. Suspended users aren't able to log in and thus their login attempt should not count.

[Aaron Wells (u-aaronw)]

Agreed, the main uses for lastlogin are auditing user activity, and showing to the user a "Welcome back, you last logged in on ___" message. For both those purposes, the last successful login is what's needed.