Disallow account deletion after confirmation

[rails.git] / app / controllers / accounts_controller.rb

diff --git a/app/controllers/accounts_controller.rb b/app/controllers/accounts_controller.rb
index 06eb031c46a2f81a18ea21f5712439a655aa9fe3..db972101088b2a958fa0f3ffe25798fec41f1bbf 100644 (file)
--- a/app/controllers/accounts_controller.rb
+++ b/app/controllers/accounts_controller.rb
@@ -51,4 +51,18 @@ class AccountsController < ApplicationController
       redirect_to auth_url(params[:user][:auth_provider], params[:user][:auth_uid]), :status => :temporary_redirect
     end
   end
+
+  def destroy
+    if current_user.deletion_allowed?
+      current_user.soft_destroy!
+
+      session.delete(:user)
+      session_expires_automatically
+
+      flash[:notice] = t ".success"
+      redirect_to root_path
+    else
+      head :bad_request
+    end
+  end
 end