- Email verification (regular, business owner), CLI administration

login.php

@@ -7,11 +7,17 @@ $err = '';
 if (isPost()) {
     csrfCheck();
     $un = ps('username'); $pw = ps('password');
-    $u = qone("SELECT * FROM users WHERE (username=? OR email=?) AND is_active=1", [$un, $un]);
+    $u = qone("SELECT * FROM users WHERE (username=? OR email=?)", [$un, $un]);
     if ($u && password_verify($pw, $u['password'])) {
-        loginUser($u);
-        flash('Welcome back, '.e($u['username']).'!', 'success');
-        go($next);
+        if (empty($u['email_verified_at'])) {
+            $err = 'Please verify your email address before signing in.';
+        } elseif ((int)$u['is_active'] !== 1) {
+            $err = 'Your account is not active. Please contact the site administrator.';
+        } else {
+            loginUser($u);
+            flash('Welcome back, '.e($u['username']).'!', 'success');
+            go($next);
+        }
     } else {
         $err = 'Invalid username or password.';
     }