0.29.0 (2016-11-21)#

Note worthy changes#

  • Addressed Django 1.10 deprecation warnings.

0.28.0 (2016-10-13)#

Security notice#

  • Previous versions contained a vulnerability allowing an attacker to alter the provider specific settings for SCOPE and/or AUTH_PARAMS (part of the larger SOCIALACCOUNT_PROVIDERS setting). The changes would persist across subsequent requests for all users, provided these settings were explicitly set within your project. These settings translate directly into request parameters, giving the attacker undesirable control over the OAuth(2) handshake. You are not affected if you did not explicitly configure these settings. Thanks to Ryan Kelly for reporting!

Note worthy changes#

  • New providers: Doximity.

  • New translations: Korean.

0.27.0 (2016-08-18)#

Note worthy changes#

  • Django 1.10 compatibility.

  • The Twitter and GitHub providers now support querying of the email address.

Backwards incompatible changes#

  • When ACCOUNT_SIGNUP_EMAIL_ENTER_TWICE was turned on, the email field key changed from email to email1, which could introduce subtle bugs. This has now been changed: there always is an email field, and optionally an email2 field.

  • The “You must type the same password each time” form validation error that can be triggered during signup is now added to the password2 field instead of being added to the non field errors.

  • The email_confirmation_sent signal is now passed request, confirmation and signup instead of only the confirmation.

  • ACCOUNT_PASSWORD_MIN_LENGTH was already deprecated, but is now completely ignored if AUTH_PASSWORD_VALIDATORS is not empty.

0.26.1 (2016-07-25)#

Note worthy changes#

  • Locale files wrongly packaged, fixed.

  • Fixed bug (KeyError) when ACCOUNT_SIGNUP_EMAIL_ENTER_TWICE was set to True.

0.26.0 (2016-07-24)#

Note worthy changes#

  • New providers: Weixin, Battle.net, Asana, Eve Online, 23andMe, Slack

  • Django’s password validation mechanism (see AUTH_PASSWORD_VALIDATORS) is now used to validate passwords.

  • By default, email confirmations are no longer stored in the database. Instead, the email confirmation mail contains an HMAC based key identifying the email address to confirm. The verification lookup includes a fallback to the previous strategy so that there is no negative impact on pending verification emails.

  • A new setting ACCOUNT_SIGNUP_EMAIL_ENTER_TWICE was added, requiring users to input their email address twice. The setting ACCOUNT_SIGNUP_PASSWORD_VERIFICATION has been renamed to ACCOUNT_SIGNUP_PASSWORD_ENTER_TWICE.

  • New translations: Latvian, Kyrgyz.

Backwards incompatible changes#

  • Dropped support for Django 1.6

  • In order to accommodate for Django’s password validation, the clean_password method of the adapter now takes an (optional) user parameter as its second argument.

  • The new HMAC based keys may contain colons. If you have forked account/urls.py, be sure to sync the account_confirm_email pattern.

0.25.2 (2016-03-13)#

Note worthy changes#

  • Bug fix release (MemcachedKeyCharacterError: “Control characters not allowed”)

0.25.1 (2016-03-13)#

Note worthy changes#

  • Bug fix release (AttributeError in password reset view).

0.25.0 (2016-03-12)#

Note worthy changes#

  • Many providers were added: Reddit, Untappd, GitLab, Stripe, Pinterest, Shopify, Draugiem, DigitalOcean, Robinhood, Bitbucket(OAuth2).

  • The account connections view is now AJAX aware.

  • You can now customize the template extension that is being used to render all HTML templates (ACCOUNT_TEMPLATE_EXTENSION)

  • In order to be secure by default, users are now blocked from logging in after exceeding a maximum number of failed login attempts (see ACCOUNT_LOGIN_ATTEMPTS_LIMIT, ACCOUNT_LOGIN_ATTEMPTS_TIMEOUT). Set ACCOUNT_LOGIN_ATTEMPTS_LIMIT to None to disable this functionality. Important: while this protects the allauth login view, it does not protect Django’s admin login from being brute forced.

  • New translations: Arabic, Lithuanian

Backwards incompatible changes#

None