Make delete account require password.

- Fixes #301

1 files changed, 9 insertions, 0 deletions

diff --git a/server/src/api/user.rs b/server/src/api/user.rs
index b0ed5a4b..2de80905 100644
--- a/server/src/api/user.rs
+++ b/server/src/api/user.rs
@@ -105,6 +105,7 @@ pub struct GetReplies {
 
 #[derive(Serialize, Deserialize)]
 pub struct DeleteAccount {
+  password: String,
   auth: String,
 }
 
@@ -601,6 +602,14 @@ impl Perform<LoginResponse> for Oper<DeleteAccount> {
 
     let user_id = claims.id;
 
+    let user: User_ = User_::read(&conn, user_id)?;
+
+    // Verify the password
+    let valid: bool = verify(&data.password, &user.password_encrypted).unwrap_or(false);
+    if !valid {
+      return Err(APIError::err(&self.op, "password_incorrect"))?;
+    }
+
     // Comments
     let comments = CommentView::list(
       &conn,