Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update django-allauth to 64.2.1 #5352

Merged
merged 1 commit into from
Sep 6, 2024

Conversation

pyup-bot
Copy link
Collaborator

@pyup-bot pyup-bot commented Sep 5, 2024

This PR updates django-allauth[mfa] from 64.2.0 to 64.2.1.

Changelog

64.2.1

*******************

Fixes
-----

- Verifying the email address by clicking on the link would no longer log you in, even
in case of ``ACCOUNT_LOGIN_ON_EMAIL_CONFIRMATION = True``.


Security notice
---------------

- It was already the case that you could not enable TOTP 2FA if your account had
unverified email addresses. This is necessary to stop a user from claiming
email addresses and locking other users out. This safety check is now added to
WebAuthn security keys as well.

- In case a user signs in into an account using social account email
authentication (``SOCIALACCOUNT_EMAIL_AUTHENTICATION``) and the email used is
not verified, the password of the account is now wiped (made unusable) to
prevent the person that created the account (without verifying it) from
signing in.
Links

@pyup-bot pyup-bot added the update label Sep 5, 2024
@browniebroke browniebroke merged commit 9b28908 into master Sep 6, 2024
14 of 15 checks passed
@browniebroke browniebroke deleted the pyup-update-django-allauth-64.2.0-to-64.2.1 branch September 6, 2024 09:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants