Merge pull request #15 from cslzchen/patch/pat-profile

[ENG-719] OAuth Profile Should Return a 404 on Deactivated Tokens
CenterForOpenScience · Jul 23, 2019 · e20a989 · e20a989
2 parents a6a1104 + 13ae50d
commit e20a989
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/views.go b/views.go
@@ -180,7 +180,7 @@ func OAuth(c echo.Context) error {
 				ON django_content_type.id = osf_guid.content_type_id AND object_id = osf_osfuser.id
 			JOIN osf_apioauth2personaltoken
 				ON osf_osfuser.id = osf_apioauth2personaltoken.owner_id
-		WHERE osf_apioauth2personaltoken.token_id = $1
+		WHERE osf_apioauth2personaltoken.token_id = $1 AND osf_apioauth2personaltoken.is_active
 	`
 	err := DatabaseConnection.QueryRow(queryString, tokenId).Scan(&result.Id, &result.Username, &result.GivenName, &result.FamilyName)
 	if err != nil {