From 677f8e49a9e5945bccb69b37f6330dc56188a1bd Mon Sep 17 00:00:00 2001
From: Shlee <github@shl.ee>
Date: Mon, 12 Jan 2026 18:50:43 +0700
Subject: [PATCH 1/2] Update permanent.blade.php

---
 resources/views/settings/remove/permanent.blade.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/resources/views/settings/remove/permanent.blade.php b/resources/views/settings/remove/permanent.blade.php
index a805ce668..904bc53f3 100644
--- a/resources/views/settings/remove/permanent.blade.php
+++ b/resources/views/settings/remove/permanent.blade.php
@@ -23,7 +23,7 @@
       <form method="post">
         @csrf
         <div class="custom-control custom-switch mb-3">
-          <input type="checkbox" class="custom-control-input" id="confirm-check">
+          <input type="checkbox" class="custom-control-input" id="confirm-check" name="confirm">
           <label class="custom-control-label font-weight-bold" for="confirm-check">I confirm that this action is not reversible, and will result in the permanent deletion of my account.</label>
         </div>
         <button type="submit" class="btn btn-danger font-weight-bold py-0 delete-btn" disabled="">Permanently delete my account</button>
@@ -48,4 +48,4 @@ $(document).ready(function() {
   });
 });
 </script>
-@endpush
\ No newline at end of file
+@endpush

From 43f6686667bf2e112e1cadd28ff1cd921ee4d7d1 Mon Sep 17 00:00:00 2001
From: Shlee <github@shl.ee>
Date: Mon, 12 Jan 2026 18:53:35 +0700
Subject: [PATCH 2/2] Update SettingsController.php

---
 app/Http/Controllers/SettingsController.php | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/app/Http/Controllers/SettingsController.php b/app/Http/Controllers/SettingsController.php
index 9b2a3c230..9cc207b75 100644
--- a/app/Http/Controllers/SettingsController.php
+++ b/app/Http/Controllers/SettingsController.php
@@ -133,6 +133,11 @@ class SettingsController extends Controller
         $user = Auth::user();
         abort_if(! config('pixelfed.account_deletion'), 403);
         abort_if($user->is_admin, 403);
+    
+        $this->validate($request, [
+            'confirm' => 'required|accepted',
+        ]);
+    
         $profile = $user->profile;
         $ts = Carbon::now()->addMonth();
         $user->email = $user->id;