Merge pull request #6408 from pixelfed/shleeable-patch-3

Bugfix: Account deletion proceeds without validation server side.

app/Http/Controllers/SettingsController.php

@@ -133,6 +133,11 @@ class SettingsController extends Controller
         $user = Auth::user();
         abort_if(! config('pixelfed.account_deletion'), 403);
         abort_if($user->is_admin, 403);
+    
+        $this->validate($request, [
+            'confirm' => 'required|accepted',
+        ]);
+    
         $profile = $user->profile;
         $ts = Carbon::now()->addMonth();
         $user->email = $user->id;

resources/views/settings/remove/permanent.blade.php

@@ -23,7 +23,7 @@
       <form method="post">
         @csrf
         <div class="custom-control custom-switch mb-3">
-          <input type="checkbox" class="custom-control-input" id="confirm-check">
+          <input type="checkbox" class="custom-control-input" id="confirm-check" name="confirm">
           <label class="custom-control-label font-weight-bold" for="confirm-check">I confirm that this action is not reversible, and will result in the permanent deletion of my account.</label>
         </div>
         <button type="submit" class="btn btn-danger font-weight-bold py-0 delete-btn" disabled="">Permanently delete my account</button>
@@ -48,4 +48,4 @@ $(document).ready(function() {
   });
 });
 </script>
-@endpush
+@endpush