From 320141855afc58b5aac666716e51504dc375b561 Mon Sep 17 00:00:00 2001
From: NOrtmann1 <ortmann.niklas@yahoo.de>
Date: Sun, 19 Jul 2026 15:54:15 +0200
Subject: [PATCH] Update deleteAccount-controller.php

---
 php/controller/deleteAccount-controller.php | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/php/controller/deleteAccount-controller.php b/php/controller/deleteAccount-controller.php
index 351364d..d65b51c 100644
--- a/php/controller/deleteAccount-controller.php
+++ b/php/controller/deleteAccount-controller.php
@@ -5,12 +5,24 @@ if (session_status() === PHP_SESSION_NONE) {
 
 require_once __DIR__ . "/../model/UserManager.php";
 require_once __DIR__ . "/../model/ArticleManager.php";
+require_once __DIR__ . "/../../includes/csrf.php";
 
 if (!isset($_SESSION["user"])) {
     header("Location: index.php?pfad=login");
     exit();
 }
 
+if ($_SERVER["REQUEST_METHOD"] !== "POST") {
+    header("Location: ../../index.php?pfad=profile");
+    exit();
+}
+
+if (!csrf_verify()) {
+    $_SESSION["message"] = "invalid_csrf_token";
+    header("Location: ../../index.php?pfad=profile");
+    exit();
+}
+
 /*
     Deregistrierung
     Funktion: Entfernt User aus der Datenbank und beendet die Session