3

I'd like to allow a non-admin user to remove their own account from the front end of my app, without allowing them CP access.

I'm concerned that if I give the user group deleteUser permissions they will just be able to delete any other non-admin user if they change the values of my forms hidden inputs.

Here is my current form:

<form method="post" accept-charset="UTF-8">
  {{ getCsrfInput() }}
  <input type="hidden" name="action" value="users/deleteUser">
  <input type="hidden" name="redirect" value="account/delete/success">
  <input type="hidden" name="userId" value="{{ currentUser.id }}">
  <button type="submit" class="btn  btn--red">Delete my account!</button>
</form>

Is it best that I create a custom controller action to handle this and first check they are only deleting themselves before passing it off to the craft()->users->deleteUser() function? Or is there a better way?

| improve this question | | | | |
4

I think you hit the nail on the head!

Including the userId in the front-end form give them the perfect opportunity to delete whoever they want... even just by guessing random IDs. That definitely seems like a huge security risk.

But if you build your own custom controller, you can guarantee that the current user is the one being deleted.

| improve this answer | | | | |
  • +1 for a plugin with your own controller. – Brad Bell Nov 6 '14 at 18:09
  • Thanks Lindsey! I figured this would be the way to go, just thought I'd check see if I'd missed anything :) – Josh Angell Nov 6 '14 at 22:18
  • How does one use the deleteUser function? In the Craft 3 Class Reference, there is docs.craftcms.com/api/v3/… and docs.craftcms.com/api/v3/… but I cannot find more info on its usage. – iamkeir Apr 1 at 15:27
  • 1
    @iamkeir You should create a new question. Feel free to link back to this page if you feel it is relevant. This particular thread was answered and closed in 2014... the answer is actually specific to Craft 2, not Craft 3. – Lindsey D Apr 2 at 3:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.