go-gitea
Fix account deletion for users without passwords
Hides the password input of the account deletion form if the user does not have a password (i.e. they registered with OAuth or similar and never set a password) and puts a note saying that they must create a password before being able to delete their account.
Before:
(with a 500 error after attempting to confirm deletion)
After:
Closes #18329.
I just worry about such approach would lead to some security problems. Deleting an account indeed requires some last step "verification".
My thought in https://github.com/go-gitea/gitea/issues/18329#issuecomment-1017267372 is:
A possible solution could be: we save the external login time in session, then if a user wants to delete the account within 1 minute after login, we allow it. This solution make every user have a chance to delete their account with a fresh external login.
I am not sure whether my idea is good enough either, so feel free to consider it or not.
I agree that this approach has problems in terms of security. I think another good alternative could be disabling the button and adding a note along the lines of "you must set a password before you can delete your account."
I agree that this approach has problems in terms of security. I think another good alternative could be disabling the button and adding a note along the lines of "you must set a password before you can delete your account."
Please send another PR or update this PR to the new approach.
Maybe we'd say if there is no password, the account can only be deleted by the administrator? Where can the password be set?
Where can the password be set?
The top of the account settings page has the password change form (above the account deletion one) so I thought the message wouldn't need to tell its location.
Another idea would be to not request the password but send an email with a confirmation link. That would work for all types of accounts.
For non-local users, maybe they should not allowed to delete the account themselves.
For non-local users, maybe they should not allowed to delete the account themselves.
I think all users should be able to, if we want to comply with "Right to be forgotten".
