evazion 8bd60e41a1 Fix #4555: Invalidate sessions for deleted users ...

Fix three exploits that allowed one to keep using their account after it was deleted:

* It was possible to use session cookies from another computer to login after you deleted your account.
* It was possible to use API keys to make API requests after you deleted your account.
* It was possible to request a password reset, delete your account, then use the password reset link
  to change your password and login to your deleted account.

2022-11-06 14:58:08 -06:00

5.0 KiB

Raw Blame History

View Raw