Fix token authentication for deleted users

binder/plugins/token_auth/middleware.py

@@ -81,7 +81,7 @@ def __call__(self, request):
 			return self.get_response(request)
 
 		try:
-			token = Token.objects.get(token=token)
+			token = Token.objects.get(token=token, user__is_active=True)
 		except Token.DoesNotExist:
 			# Token does not exist
 			# Raise and catch needed to provide location

changelog/CRTX-969

@@ -0,0 +1 @@
+- [CRTX-969] Fix issue where tokens for deleted users are still valid

tests/plugins/test_token_auth.py

@@ -57,6 +57,14 @@ def test_token_expired(self):
 			EXTRA(): None,
 		})
 
+	def test_deactivated_user_token_auth(self):
+		# A deactivated user should not be able to authenticate with a token.
+		self.user.is_active = False
+		self.user.save()
+
+		res = self.client.get('/user/identify/')
+		self.assertEqual(res.status_code, 404)
+
 	def test_token_not_found(self):
 		old_token = self.token.token
 		self.token.token = 'foo'