0.29.0 (2016-11-21)#
Note worthy changes#
Addressed Django 1.10 deprecation warnings.
0.28.0 (2016-10-13)#
Security notice#
Previous versions contained a vulnerability allowing an attacker to alter the provider specific settings for
SCOPE
and/orAUTH_PARAMS
(part of the largerSOCIALACCOUNT_PROVIDERS
setting). The changes would persist across subsequent requests for all users, provided these settings were explicitly set within your project. These settings translate directly into request parameters, giving the attacker undesirable control over the OAuth(2) handshake. You are not affected if you did not explicitly configure these settings. Thanks to Ryan Kelly for reporting!
Note worthy changes#
New providers: Doximity.
New translations: Korean.
0.27.0 (2016-08-18)#
Note worthy changes#
Django 1.10 compatibility.
The Twitter and GitHub providers now support querying of the email address.
Backwards incompatible changes#
When
ACCOUNT_SIGNUP_EMAIL_ENTER_TWICE
was turned on, the email field key changed fromemail
toemail1
, which could introduce subtle bugs. This has now been changed: there always is anemail
field, and optionally anemail2
field.The “You must type the same password each time” form validation error that can be triggered during signup is now added to the
password2
field instead of being added to the non field errors.The
email_confirmation_sent
signal is now passedrequest
,confirmation
andsignup
instead of only theconfirmation
.ACCOUNT_PASSWORD_MIN_LENGTH
was already deprecated, but is now completely ignored ifAUTH_PASSWORD_VALIDATORS
is not empty.
0.26.1 (2016-07-25)#
Note worthy changes#
Locale files wrongly packaged, fixed.
Fixed bug (
KeyError
) whenACCOUNT_SIGNUP_EMAIL_ENTER_TWICE
was set toTrue
.
0.26.0 (2016-07-24)#
Note worthy changes#
New providers: Weixin, Battle.net, Asana, Eve Online, 23andMe, Slack
Django’s password validation mechanism (see
AUTH_PASSWORD_VALIDATORS
) is now used to validate passwords.By default, email confirmations are no longer stored in the database. Instead, the email confirmation mail contains an HMAC based key identifying the email address to confirm. The verification lookup includes a fallback to the previous strategy so that there is no negative impact on pending verification emails.
A new setting
ACCOUNT_SIGNUP_EMAIL_ENTER_TWICE
was added, requiring users to input their email address twice. The settingACCOUNT_SIGNUP_PASSWORD_VERIFICATION
has been renamed toACCOUNT_SIGNUP_PASSWORD_ENTER_TWICE
.New translations: Latvian, Kyrgyz.
Backwards incompatible changes#
Dropped support for Django 1.6
In order to accommodate for Django’s password validation, the
clean_password
method of the adapter now takes an (optional)user
parameter as its second argument.The new HMAC based keys may contain colons. If you have forked
account/urls.py
, be sure to sync theaccount_confirm_email
pattern.
0.25.2 (2016-03-13)#
Note worthy changes#
Bug fix release (MemcachedKeyCharacterError: “Control characters not allowed”)
0.25.1 (2016-03-13)#
Note worthy changes#
Bug fix release (AttributeError in password reset view).
0.25.0 (2016-03-12)#
Note worthy changes#
Many providers were added: Reddit, Untappd, GitLab, Stripe, Pinterest, Shopify, Draugiem, DigitalOcean, Robinhood, Bitbucket(OAuth2).
The account connections view is now AJAX aware.
You can now customize the template extension that is being used to render all HTML templates (
ACCOUNT_TEMPLATE_EXTENSION
)In order to be secure by default, users are now blocked from logging in after exceeding a maximum number of failed login attempts (see
ACCOUNT_LOGIN_ATTEMPTS_LIMIT
,ACCOUNT_LOGIN_ATTEMPTS_TIMEOUT
). SetACCOUNT_LOGIN_ATTEMPTS_LIMIT
toNone
to disable this functionality. Important: while this protects the allauth login view, it does not protect Django’s admin login from being brute forced.New translations: Arabic, Lithuanian
Backwards incompatible changes#
None