Don't send password reset emails to deleted user accounts

diff --git a/mod/lostpass.php b/mod/lostpass.php
index 62b621b8ce24a66a7fa3ed3330144b40f85f79fb..f840f2fb62beb1d23f4d1cbb5a4887ad3c3d6e9d 100644 (file)
--- a/mod/lostpass.php
+++ b/mod/lostpass.php
@@ -34,7 +34,7 @@ function lostpass_post(App $a)
                DI::baseUrl()->redirect();
        }
 
-       $condition = ['(`email` = ? OR `nickname` = ?) AND `verified` = 1 AND `blocked` = 0', $loginame, $loginame];
+       $condition = ['(`email` = ? OR `nickname` = ?) AND `verified` = 1 AND `blocked` = 0 AND `account_removed` = 0 AND `account_expired` = 0', $loginame, $loginame];
        $user = DBA::selectFirst('user', ['uid', 'username', 'nickname', 'email', 'language'], $condition);
        if (!DBA::isResult($user)) {
                DI::sysmsg()->addNotice(DI::l10n()->t('No valid account found.'));