Merge branch 'release-4.0'

2 files changed, 43 insertions, 0 deletions

diff --git a/store/sql_oauth_store.go b/store/sql_oauth_store.go
index 8637055ae..2e6fe2655 100644
--- a/store/sql_oauth_store.go
+++ b/store/sql_oauth_store.go
@@ -9,6 +9,7 @@ import (
 
 	"github.com/mattermost/gorp"
 	"github.com/mattermost/platform/model"
+	"github.com/mattermost/platform/utils"
 )
 
 type SqlOAuthStore struct {
@@ -521,6 +522,24 @@ func (as SqlOAuthStore) deleteApp(transaction *gorp.Transaction, clientId string
 		return result
 	}
 
+	return as.deleteOAuthAppSessions(transaction, clientId)
+}
+
+func (as SqlOAuthStore) deleteOAuthAppSessions(transaction *gorp.Transaction, clientId string) StoreResult {
+	result := StoreResult{}
+
+	query := ""
+	if utils.Cfg.SqlSettings.DriverName == model.DATABASE_DRIVER_POSTGRES {
+		query = "DELETE FROM Sessions s USING OAuthAccessData o WHERE o.Token = s.Token AND o.ClientId = :Id"
+	} else if utils.Cfg.SqlSettings.DriverName == model.DATABASE_DRIVER_MYSQL {
+		query = "DELETE s.* FROM Sessions s INNER JOIN OAuthAccessData o ON o.Token = s.Token WHERE o.ClientId = :Id"
+	}
+
+	if _, err := transaction.Exec(query, map[string]interface{}{"Id": clientId}); err != nil {
+		result.Err = model.NewLocAppError("SqlOAuthStore.DeleteApp", "store.sql_oauth.delete_app.app_error", nil, "id="+clientId+", err="+err.Error())
+		return result
+	}
+
 	return as.deleteOAuthTokens(transaction, clientId)
 }
 
diff --git a/store/sql_oauth_store_test.go b/store/sql_oauth_store_test.go
index 8c707562f..4dc09b830 100644
--- a/store/sql_oauth_store_test.go
+++ b/store/sql_oauth_store_test.go
@@ -414,7 +414,31 @@ func TestOAuthStoreDeleteApp(t *testing.T) {
 		t.Fatal(err)
 	}
 
+	s1 := model.Session{}
+	s1.UserId = model.NewId()
+	s1.Token = model.NewId()
+	s1.IsOAuth = true
+
+	Must(store.Session().Save(&s1))
+
+	ad1 := model.AccessData{}
+	ad1.ClientId = a1.Id
+	ad1.UserId = a1.CreatorId
+	ad1.Token = s1.Token
+	ad1.RefreshToken = model.NewId()
+	ad1.RedirectUri = "http://example.com"
+
+	Must(store.OAuth().SaveAccessData(&ad1))
+
 	if err := (<-store.OAuth().DeleteApp(a1.Id)).Err; err != nil {
 		t.Fatal(err)
 	}
+
+	if err := (<-store.Session().Get(s1.Token)).Err; err == nil {
+		t.Fatal("should error - session should be deleted")
+	}
+
+	if err := (<-store.OAuth().GetAccessData(s1.Token)).Err; err == nil {
+		t.Fatal("should error - access data should be deleted")
+	}
 }