Fixed OAuth tokens aren't removed on account deletion

S

stromb0li

Well-known member
Licensed customer
Affected version
2.3.10
It looks like oauth tokens aren't cleaned up during account deletion.

The User entity's _postDelete() doesn't seem to invoke cleanup on these tables, nor do I see anything in DeleteCleanUpService.php

Tables in question:
  • xf_api_login_token
  • xf_oauth_token
  • xf_oauth_request
  • xf_oauth_refresh_token
 
Last edited:
Thank you for reporting this issue, it has now been resolved. We are aiming to include any changes that have been made in a future XF release (2.3.11).

Change log:
Delete xf_api_login_token, xf_oauth_token, xf_oauth_request and the linked xf_oauth_refresh_token rows during user account deletion so abandoned access tokens and OAuth authorization records do not linger after the user is gone.
Click to expand...
There may be a delay before changes are rolled out to the XenForo Community.
 
Back
Top Bottom