how to restrict user login whenever if a user puts on hold by editing wp-login action?

Question

I have written a functionality like super admin can put user accounts on "hold". I have to make sure the user account which put his account on hold unable to login. The problem here is the user is able to login if still his account is on hold. I am using a 'custom user meta' field called 'holdUser' while super admin put a user on hold. While user login I am using the wordpress's wp-login action, how to edit wp-login action so that a user cannot login based on a custom user meta field in wordpress. While user account is put on hold I am updating the 'user meta' like below:

if(isset($_GET['user_id']) && ($_GET['action']=='hold'))
{
  update_user_meta( $_GET['user_id'], 'holdUser',1 );
  wp_mail($email_to, $subject, $content,$headers);
}

My Login form has the following code:

<form method="post" action="'.$this->SiteUrl.'wp-login.php">
  <input type="text" id="user_login" name="log">
  <input type="password" name="pwd">
  <button target="" class="submit">Login</button>
</form>

My Question here is how to edit 'wp-login.php' hook based on a user_meta field 'holdUser' if its value is 1 then not to login that user.?

Update: I wrote a separate hook if user login fails like below:

add_action( 'wp_login_failed', 'my_front_end_login_fail' );
function my_front_end_login_fail( $username ) {
  $referrer = $_SERVER['HTTP_REFERER'];
  if( !empty($referrer) && !strstr($referrer,'wp-login') && !strstr($referrer,'wp-admin') )
  {
    if ( !strstr($referrer,'/?actiont=failed') )
    {
      wp_redirect( $referrer . '/?actiont=failed&message=authentication-failed' );
    }
    else 
    {
      wp_redirect( $referrer );
    }
    exit;
  }
}

how can I get that on hold message from 'on_hold_error' hook?

Answer 1

function myplugin_authenticate_on_hold($user)
{
    // username and password are correct
    if ($user instanceof WP_User) {
        $on_hold = get_user_meta($user->ID, 'is_on_hold', true);
        if ($on_hold) {
            return new WP_Error('on_hold_error', 'You are on hold');
        }
    }

    return $user;
}

add_filter('authenticate', 'myplugin_authenticate_on_hold', 21);

The priority needs to be 21, as wp_authenticate_username_password and wp_authenticate_email_password are priority 20. They return an object of the type WP_User if they could authenticate the user. So if the user is authenticated, check if he is on hold. If he is, show the user an error.

Edit: why aren't you using the default login form?

Answer 2

Use the wp_authenticate_user filter and return a WP_Error to stop the login.

add_filter( 'wp_authenticate_user', 'my_theme_authenticate_user', 1 );

function my_theme_authenticate_user( $user ) {

    if ( is_wp_error( $user ) ) {
        return $user;
    }


    $on_hold = get_user_meta($user->ID, 'holdUser', true );
    if ( (int)$on_hold == 1) {
        return new WP_Error( 'get lost' );
    }

    return $user;
}

(put the above in your theme's functions.php)

Also, I think you may need to give your form element name="loginform", in order for WordPress to pick up on it and treat it just like the native WP login form and fire all the same hooks, but not sure on this.

PS: It's recommended to use wp_login_form() to create your custom login form, as you'll get other features such as easy way of specifying a redirect URL. https://codex.wordpress.org/Function_Reference/wp_login_form