update /user/delete defroute: add 'type username input check'.

When the user wants to delete their account they must now enter their
username as part of the form they submit. This is so they don't
accidently delete thier account.

src/web.lisp

@@ -545,25 +545,38 @@
 
 (defroute ("/user/delete" :method :POST) ()
   (destructuring-bind
-      (&key authenticity-token &allow-other-keys)
+      (&key authenticity-token delete-account-check &allow-other-keys)
       (utils:request-params (lack.request:request-body-parameters ningle:*request*))
     (cond ((not (string= authenticity-token (auth:csrf-token)))
 	   `(,+forbidden+ (:content-type "text/plain") ("Denied")))
 	  (t (hermetic:auth (:logged-in)
 			    ;; Authorised
-			    (progn
+			    (cond ((utils:string-is-nil-or-empty? delete-account-check)
-			      (nera-db:delete-user
+				   (utils:set-alert
-			       (user::username-of (auth:get-current-user)))
+				    "No username entered. Account not deleted."
-			      (hermetic:logout
+				    "missing-data")
-			       ;; Successful log-out -- after account deleted
+				   (redirect "/user/edit"))
-			       ;; (session data cleared).
+				  ((not (string= delete-account-check
-			       (progn (auth:flash-gethash :id ningle:*session*)
+						 (user::username-of
-				      (redirect "/"))
+						  (auth:get-current-user))))
-			       ;; Failed log-out -- after account deleted
+				   (utils:set-alert
-			       ;; (session data persits).
+				    "Wrong username entered. Account not deleted."
-			       (progn (utils:set-alert
+				    "invalid-data")
-				       "Unable to delete session data." "error")
+				   (redirect "/user/edit"))
-				      (redirect "/"))))
+				  (t
+				   (progn
+				     (nera-db:delete-user
+				      (user::username-of (auth:get-current-user)))
+				     (hermetic:logout
+				      ;; Successful log-out -- after account deleted
+				      ;; (session data cleared).
+				      (progn (auth:flash-gethash :id ningle:*session*)
+					     (redirect "/"))
+				      ;; Failed log-out -- after account deleted
+				      ;; (session data persits).
+				      (progn (utils:set-alert
+					      "Unable to delete session data." "error")
+					     (redirect "/"))))))
 			    ;; Not Authorised
 			    (progn (utils:set-alert "You are not logged in."
 						    "error")