Default SOCIAL_AUTH_ASSOCIATE_BY_EMAIL to False to avoid some secury risks (while...

diff --git a/README.rst b/README.rst
index 9abd2741fc7548d5a861146946eb7540d4bbc4c3..1dc328215a5c9a535f9450086de152b852d6026f 100644 (file)
--- a/README.rst
+++ b/README.rst
@@ -335,9 +335,9 @@ Configuration
 
   It is also possible to associate multiple user accounts with a single email
   address, set value as True to enable, otherwise set as False to disable.
-  This behavior is enabled by default (True) unless specifically set::
+  This behavior is disabled by default (False) unless specifically set::
 
-      SOCIAL_AUTH_ASSOCIATE_BY_MAIL = False
+      SOCIAL_AUTH_ASSOCIATE_BY_MAIL = True
 
 - You can send extra parameters on auth process by defining settings per
   provider, example to request Facebook to show Mobile authorization page,

diff --git a/doc/configuration.rst b/doc/configuration.rst
index c10a335a3f6182681d86038b07a31242ccac8483..3837a56e7f4088ef72365e9239ddf2359b5bed0e 100644 (file)
--- a/doc/configuration.rst
+++ b/doc/configuration.rst
@@ -216,9 +216,9 @@ Configuration
 
   It is also possible to associate multiple user accounts with a single email
   address, set value as True to enable, otherwise set as False to disable.
-  This behavior is enabled by default (True) unless specifically set::
+  This behavior is disabled by default (False) unless specifically set::
 
-      SOCIAL_AUTH_ASSOCIATE_BY_MAIL = False
+      SOCIAL_AUTH_ASSOCIATE_BY_MAIL = True
 
 - You can send extra parameters on auth process by defining settings per
   provider, example to request Facebook to show Mobile authorization page,

diff --git a/social_auth/backends/pipeline/associate.py b/social_auth/backends/pipeline/associate.py
index 4679c063de4e68248f2fa6419460bbfe1e868331..2d2e5ddfec45ce7b7d1d5b01c0fb120fde9bf5c8 100644 (file)
--- a/social_auth/backends/pipeline/associate.py
+++ b/social_auth/backends/pipeline/associate.py
@@ -15,7 +15,7 @@ def associate_by_email(details, user=None, *args, **kwargs):
 
     warn_setting('SOCIAL_AUTH_ASSOCIATE_BY_MAIL', 'associate_by_email')
 
-    if email and setting('SOCIAL_AUTH_ASSOCIATE_BY_MAIL', True):
+    if email and setting('SOCIAL_AUTH_ASSOCIATE_BY_MAIL', False):
         # try to associate accounts registered with the same email address,
         # only if it's a single object. AuthException is raised if multiple
         # objects are returned