0.38.0 (2018-10-03)#

Security notice#

The {% user_display user %} tag did not escape properly. Depending on the username validation rules, this could lead to XSS issues.

Note worthy changes#

  • New provider: Vimeo (OAuth2).

  • New translations: Basque.

0.37.1 (2018-08-27)#

Backwards incompatible changes#

  • Dropped the x-li-src: msdk headers from the linkedin_oauth2 handshake. This header is only required for mobile tokens, and breaks the regular flow. Use the HEADERS setting to add this header if you need it.

0.37.0 (2018-08-27)#

Note worthy changes#

  • The Battle.net login backend now recognizes apac as a valid region.

  • User model using a UUIDField as it’s primary key can now be logged in upon email confirmation (if using ACCOUNT_LOGIN_ON_EMAIL_CONFIRMATION).

  • New providers: Agave, Cern, Disqus, Globus.

  • New translation: Danish.

0.36.0 (2018-05-08)#

Note worthy changes#

  • New providers: Telegram, QuickBooks.

  • The Facebook API version now defaults to v2.12.

  • ORCID upgraded to use API v2.1.

Security notice#

  • In previous versions, the authentication backend did not invoke the user_can_authenticate() method, potentially allowing users with is_active=False to authenticate when the allauth authentication backend was used in a non allauth context.

0.35.0 (2018-02-02)#

Note worthy changes#

  • Add support for Django 2.0

Security notice#

  • As an extra security measure on top of what the standard Django password reset token generator is already facilitating, allauth now adds the user email address to the hash such that whenever the user’s email address changes the token is invalidated.

Backwards incompatible changes#

  • Drop support for Django 1.8 and Django 1.10.

Note worthy changes#

  • New provider: Azure, Microsoft Graph, Salesforce, Yahoo.