deleting accounts

index.php

@@ -85,6 +85,22 @@ if ($user === false) {
         )
       );
     }
+  } else if ($intent === "delete-account") {
+    $pw = $_POST["password"];
+
+    if (!$pw) {
+      $err = $lang["account"]["errors"]["bad_request"];
+    } else if (password_verify($pw, $user["password_hash"])) {
+      pg_delete(
+        $db, "users",
+        array("username" => $user["username"])
+      );
+      header("Location: logout.php");
+      http_response_code(302);
+      exit();
+    } else {
+      $err = $lang["account"]["errors"]["incorrect_password"];
+    }
   } else if ($intent === "update-texts") {
     foreach ($_POST as $ident => $value) {
       if (preg_match("/^(?:section-[a-f0-9]{64}-name)|(?:row-[a-f0-9]{64}-(?:name|format))$/", $ident)) {
@@ -431,6 +447,17 @@ foreach ($sections as $section) {
             </tr>
           </table>
         </form>
+
+        <h4><?php echo $lang["settings"]["account"]["delete"]["title"]; ?></h4>
+        <form method="POST">
+          <input type="hidden" name="intent" value="delete-account">
+          <div><input type="password" name="password" placeholder="<?php echo $lang["settings"]["account"]["delete"]["password"]; ?>" required></div>
+          <div><label>
+            <?php echo $lang["settings"]["account"]["delete"]["confirmation"]; ?>
+            <input type="checkbox" required>
+          </label></div>
+          <div><input type="submit" value="<?php echo $lang["settings"]["account"]["delete"]["button"]; ?>"></div>
+        </form>
       </div>
     </div>
     <p>

lang/en-US.json

@@ -109,6 +109,13 @@
         "button": "Save"
       },
 
+      "delete": {
+        "title": "Delete Account",
+        "password": "Password",
+        "confirmation": "This is irriversible and cannot be undone.",
+        "button": "Delete"
+      },
+
       "title": "Account",
       "current": "Currently logged in as %u.",
       "log_out": "Log out?"

logout.php

@@ -1,5 +1,6 @@
 <?php
   setcookie("token", "", -1);
   header("Location: index.php");
+  http_response_code(302);
   exit();
 ?>