From ddb51c0e95074c6fbddade547ca267801177bb01 Mon Sep 17 00:00:00 2001 From: Inverle Date: Mon, 15 Sep 2025 22:17:14 +0200 Subject: Fix another user self-delete regression (#7877) Regression from #7763 Earlier regression which was fixed before #7626 In addition: * get rid of `data-toggle` (refactor) * show invalid login message if deleting account and entered incorrect password instead of redirect to 403 * remove unused reference to `r` parameter * `forgetOpenCategories()` on login not on any crypto form --- app/Controllers/userController.php | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) (limited to 'app/Controllers/userController.php') diff --git a/app/Controllers/userController.php b/app/Controllers/userController.php index 1f4452523..e71c8aaa0 100644 --- a/app/Controllers/userController.php +++ b/app/Controllers/userController.php @@ -635,13 +635,16 @@ class FreshRSS_user_Controller extends FreshRSS_ActionController { $username, FreshRSS_Context::userConf()->passwordHash, $nonce, $challenge ); + if (!$ok) { + Minz_Request::bad(_t('feedback.auth.login.invalid'), ['c' => 'user', 'a' => 'profile']); + return; + } } elseif (self::reauthRedirect()) { return; } - if ($ok) { - $ok &= self::deleteUser($username); - } + $ok &= self::deleteUser($username); + if ($ok && $self_deletion) { FreshRSS_Auth::removeAccess(); $redirect_url = ['c' => 'index', 'a' => 'index']; -- cgit v1.2.3