From ca0759c8abcc3aea0ceb0c05dc15b631398dced2 Mon Sep 17 00:00:00 2001
From: Miraty <miraty+git@antopie.org>
Date: Thu, 9 Mar 2023 14:23:28 +0100
Subject: [PATCH] auth/username auth/unregister: password confirmation

---
 pg-act/auth/unregister.php  | 3 +++
 pg-act/auth/username.php    | 3 +++
 pg-view/auth/unregister.php | 7 +++++--
 pg-view/auth/username.php   | 3 +++
 4 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/pg-act/auth/unregister.php b/pg-act/auth/unregister.php
index c25dc8b..65a5ae5 100644
--- a/pg-act/auth/unregister.php
+++ b/pg-act/auth/unregister.php
@@ -1,5 +1,8 @@
 <?php
 
+if (checkPassword($_SESSION['id'], $_POST['current-password']) !== true)
+	output(403, _('Wrong current password.'));
+
 if (!isset($_POST['delete']))
 	output(403, _('Account deletion must be confirmed.'));
 
diff --git a/pg-act/auth/username.php b/pg-act/auth/username.php
index 5716fac..2a9062e 100644
--- a/pg-act/auth/username.php
+++ b/pg-act/auth/username.php
@@ -2,6 +2,9 @@
 
 checkUsernameFormat($_POST['new-username']);
 
+if (checkPassword($_SESSION['id'], $_POST['current-password']) !== true)
+	output(403, _('Wrong current password.'));
+
 $username = hashUsername($_POST['new-username']);
 
 if (usernameExists($username) !== false)
diff --git a/pg-view/auth/unregister.php b/pg-view/auth/unregister.php
index 60f502b..f517c39 100644
--- a/pg-view/auth/unregister.php
+++ b/pg-view/auth/unregister.php
@@ -3,8 +3,11 @@
 </p>
 
 <form method="post">
+	<label for="current-password"><?= _('Current password') ?></label><br>
+	<input required="" autocomplete="current-password" minlength="8" maxlength="1024" pattern="<?= PASSWORD_REGEX ?>" id="current-password" name="current-password" type="password" placeholder="<?= PLACEHOLDER_PASSWORD ?>"><br>
+
 	<input type="checkbox" name="delete" id="delete" required="">
-	<label for="delete"><?= _('Delete the current account and everything related (required)') ?></label>
-	<br>
+	<label for="delete"><?= _('Delete the current account and everything related (required)') ?></label><br>
+
 	<input type="submit" value="<?= _('Delete') ?>">
 </form>
diff --git a/pg-view/auth/username.php b/pg-view/auth/username.php
index 9b55d2f..1bba92e 100644
--- a/pg-view/auth/username.php
+++ b/pg-view/auth/username.php
@@ -1,4 +1,7 @@
 <form method="post">
+	<label for="current-password"><?= _('Current password') ?></label><br>
+	<input required="" autocomplete="current-password" minlength="8" maxlength="1024" pattern="<?= PASSWORD_REGEX ?>" id="current-password" name="current-password" type="password" placeholder="<?= PLACEHOLDER_PASSWORD ?>"><br>
+
 	<label for="new-username"><?= _('New username') ?></label><br>
 	<input required="" autocomplete="username" minlength="1" maxlength="1024" pattern="<?= USERNAME_REGEX ?>" id="new-username" name="new-username" type="text" placeholder="<?= PLACEHOLDER_USERNAME ?>"><br>