admin_change_password.php

<?php
include 'includes/db.php';
include 'includes/header.php';

// Only allow admin
if (!isset($_SESSION['user_id']) || $_SESSION['role'] !== 'admin') {
    header('Location: login.php?type=admin');
    exit();
}

$change_password_success = false;
if (isset($_POST['change_admin_password'])) {
    $current_password = $_POST['current_password'];
    $new_password = $_POST['new_password'];
    $confirm_new_password = $_POST['confirm_new_password'];

    $stmt = $pdo->prepare("SELECT * FROM users WHERE id = ?");
    $stmt->execute([$_SESSION['user_id']]);
    $admin = $stmt->fetch(PDO::FETCH_ASSOC);

    if ($admin && password_verify($current_password, $admin['password'])) {
        if ($new_password === $confirm_new_password) {
            if (strlen($new_password) >= 6) {
                $hashed_new_password = password_hash($new_password, PASSWORD_DEFAULT);
                $stmt = $pdo->prepare("UPDATE users SET password = ? WHERE id = ?");
                $stmt->execute([$hashed_new_password, $_SESSION['user_id']]);
                $change_password_message = "Password changed successfully.";
                $change_password_success = true;
            } else {
                $change_password_message = "New password must be at least 6 characters.";
            }
        } else {
            $change_password_message = "New passwords do not match.";
        }
    } else {
        $change_password_message = "Current password is incorrect.";
    }
}
?>

<div class="main-content">
    <?php include 'includes/sidebar.php'; ?>
    <div class="content-sections">
        <section class="content-section">
            <h2>Change Password</h2>
            <form method="POST" style="max-width:400px;">
                <div class="form-group">
                    <label class="form-label">Current Password</label>
                    <input type="password" name="current_password" class="form-input" required>
                </div>
                <div class="form-group">
                    <label class="form-label">New Password</label>
                    <input type="password" name="new_password" class="form-input" required>
                </div>
                <div class="form-group">
                    <label class="form-label">Confirm New Password</label>
                    <input type="password" name="confirm_new_password" class="form-input" required>
                </div>
                <button type="submit" name="change_admin_password" class="btn">Change Password</button>
            </form>
            <?php if (isset($change_password_message)): ?>
                <div style="margin-top:1rem; color:<?php echo $change_password_success ? '#155724' : '#a00'; ?>; background:<?php echo $change_password_success ? '#e3fbe3' : '#ffe3e3'; ?>; padding:1rem; border-radius:8px;">
                    <?php echo htmlspecialchars($change_password_message); ?>
                </div>
            <?php endif; ?>
        </section>
    </div>
</div>
<?php include 'includes/footer.php'; ?>