Require password for account deletion by default #4816
Description
Current behavior
Devise requires current password in order to change account, but does not require current password for account deletion.
Expected behavior
Devise should require current password in order to delete account.
Manual solution
def destroy
if resource.destroy_with_password(params[:user][:current_password])
flash[:notice] = "Your account has been deleted"
redirect_to root_path
else
flash[:alert] = "Wrong password"
render :edit, layout: 'application'
end
end