"Suspend unauthorised accounts" setting in E-mail Factor is not honoured when invalidating login attempt on Unauthorised Email page

[alx-glover]

Accessed from the confirmation email, "If this wasn't you, follow this link to stop this login attempt.

The issue is a typo in the line that's supposed to set the suspended flag for the user record.

moodle-tool_mfa/factor/email/email.php

Line 83 in 155db3d

$DB->set_field('user', 'suspended', 1, ['id' => $userid]);

Should be:

$DB->set_field('user', 'suspended', 1, ['id' => $user->id]);

Thanks.