<?php
require_once 'config.inc.php';require_login();$pageTitle='Change Password';
if($_SERVER['REQUEST_METHOD']==='POST'){check_csrf();$old=$_POST['old_password'];$new=$_POST['new_password'];$confirm=$_POST['confirm_password'];
$s=db()->prepare("SELECT password_hash FROM admins WHERE id=?");$s->bind_param("i",$_SESSION['admin_id']);$s->execute();$a=$s->get_result()->fetch_assoc();
if(!$a||!password_verify($old,$a['password_hash']))flash('danger','Current password is incorrect.');
elseif(strlen($new)<8)flash('danger','New password must be at least 8 characters.');
elseif($new!==$confirm)flash('danger','Passwords do not match.');
else{$h=password_hash($new,PASSWORD_DEFAULT);$s=db()->prepare("UPDATE admins SET password_hash=? WHERE id=?");$s->bind_param("si",$h,$_SESSION['admin_id']);$s->execute();flash('success','Password changed successfully.');}
redirect('change_password.php');}
include 'partials/header.php';?>
<div class="card p-4" style="max-width:600px"><h5>Change Password</h5><form method="post"><input type="hidden" name="csrf" value="<?=e(csrf())?>">
<label class="form-label mt-3">Current Password</label><input class="form-control" type="password" name="old_password" required>
<label class="form-label mt-3">New Password</label><input class="form-control" type="password" name="new_password" minlength="8" required>
<label class="form-label mt-3">Confirm Password</label><input class="form-control" type="password" name="confirm_password" minlength="8" required>
<button class="btn btn-primary mt-4">Change Password</button></form></div>
<?php include 'partials/footer.php';?>
