From 8fc8898fef39af20a24c9928464fd8420481d819 Mon Sep 17 00:00:00 2001
From: Lukas Fleischer <lfleischer@archlinux.org>
Date: Thu, 30 Jan 2020 11:52:32 +0100
Subject: Require password when deleting an account

Further reduce the attack surface in case of a stolen session ID.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
---
 web/template/account_delete.php | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

(limited to 'web/template/account_delete.php')

diff --git a/web/template/account_delete.php b/web/template/account_delete.php
index 718b172f..d0c6e74d 100644
--- a/web/template/account_delete.php
+++ b/web/template/account_delete.php
@@ -12,8 +12,15 @@
 		<input type="hidden" name="token" value="<?= htmlspecialchars($_COOKIE['AURSID']) ?>" />
 	</fieldset>
 	<fieldset>
-		<p><label class="confirmation"><input type="checkbox" name="confirm" value="1" />
-		<?= __("Confirm deletion") ?></label></p>
+		<p>
+			<label for="id_passwd"><?= __("Password") ?>:</label>
+			<input type="password" size="30" name="passwd" id="id_passwd" value="" />
+		</p>
+
+		<p>
+			<label class="confirmation"><input type="checkbox" name="confirm" value="1" />
+			<?= __("Confirm deletion") ?></label>
+		</p>
 
 		<p>
 			<input type="submit" class="button" value="<?= __("Delete") ?>" />
-- 
cgit v1.2.3-24-g4f1b