Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Release new version to PyPI to address bad default value for RefreshToken revoked #589

Closed
wli opened this issue May 8, 2018 · 2 comments

Comments

@wli
Copy link

wli commented May 8, 2018

The version on pypi (1.1.0) contains a critical bug that invalidates all refresh tokens when running a migration, and is NOT noted in the changelog. This was corrected in a follow-up pull request, but was not released yet.

83ec4ac

I just ran into this bug in my production instance, which logged out all my users. For anyone else who hits this, you can run the following code AFTER you run the migration (0006_auto_20171214_2232).

from oauth2_provider.models import RefreshToken
RefreshToken.objects.update(revoked=None)

@jleclanche

wli added a commit to wli/django-oauth-toolkit that referenced this issue May 8, 2018
@jleclanche
Copy link
Member

You're right. I'll release 1.1.1 with a note.

@jleclanche
Copy link
Member

Done

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants