From ce120cbd4ffda0ef6d97a15b27b56c756b0df4cc Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 7 Mar 2026 19:53:33 +0000
Subject: [PATCH] Add delete account button with confirmation in
 sysadmin/users.php?action=edit

Co-authored-by: naielv <109038805+naielv@users.noreply.github.com>
---
 public_html/sysadmin/users.php | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/public_html/sysadmin/users.php b/public_html/sysadmin/users.php
index ddb16b5..511dc9b 100644
--- a/public_html/sysadmin/users.php
+++ b/public_html/sysadmin/users.php
@@ -61,6 +61,16 @@ function render_users_mobile_styles()
 }
 
 switch ($_GET['form'] ?? '') {
+    case 'delete_user':
+        $username = safe_username($_POST['username'] ?? '');
+        if (empty($username)) {
+            die("Nombre de usuario no proporcionado.");
+        }
+        db_delete_user($username);
+        db_delete_user_sessions($username);
+        header("Location: ?action=index&_result=" . urlencode("Usuario \"$username\" eliminado correctamente."));
+        exit;
+
     case 'save_edit':
         $username = safe_username($_POST['username'] ?? '');
         if (empty($username)) {
@@ -368,6 +378,16 @@ switch ($_GET['action'] ?? '') {
     </div>
   </div>
 </form>
+<form method="post" action="?form=delete_user" class="users-mobile-stack mt-2" onsubmit="return confirm('¿Seguro que quieres eliminar la cuenta de <?= htmlspecialchars($username, ENT_QUOTES) ?>? Esta acción no se puede deshacer.');">
+  <div class="card pad border-danger">
+    <div>
+      <h2 class="text-danger">Zona de peligro</h2>
+      <p>Eliminar la cuenta borrará permanentemente al usuario y todas sus sesiones activas.</p>
+      <input type="hidden" name="username" value="<?= htmlspecialchars($username) ?>">
+      <button type="submit" class="btn btn-danger">Eliminar cuenta</button>
+    </div>
+  </div>
+</form>
 <?php
         require_once "_incl/post-body.php";
         break;