SWAMPy

✎ CARVE FLESH

EDITING: change-password.php

<?php

// admin/auth/change-password.php
//
// PUT /api/admin/auth/change-password.php
// Body: { "current_password": "...", "new_password": "..." }
// Response: { "success": true, "data": { "success": true } }

require_once __DIR__ . '/../../config/database.php';
require_once __DIR__ . '/../../helpers/response.php';
require_once __DIR__ . '/../../middleware/auth.php';
require_once __DIR__ . '/../../models/AdminUser.php';

if ($_SERVER['REQUEST_METHOD'] !== 'PUT') {
    json_error('METHOD_NOT_ALLOWED', 'Only PUT is supported.', 405);
}

$adminUser = authMiddleware(); // any authenticated admin can change their own password

$pdo = require __DIR__ . '/../../config/database.php';
$adminModel = new AdminUser($pdo);

$input = json_decode(file_get_contents('php://input'), true);
$currentPassword = trim($input['current_password'] ?? '');
$newPassword = trim($input['new_password'] ?? '');

if (empty($currentPassword) || empty($newPassword)) {
    json_error('VALIDATION_ERROR', 'current_password and new_password are required.', 422);
}

if (strlen($newPassword) < 6) {
    json_error('VALIDATION_ERROR', 'New password must be at least 6 characters.', 422);
}

try {
    $adminId = (int)$adminUser->id;
    $admin = $adminModel->findByIdWithHash($adminId);

if (!$admin) {
        json_error('NOT_FOUND', 'Admin account not found.', 404);
    }

if (!$adminModel->verifyPassword($currentPassword, $admin['password_hash'])) {
        json_error('INVALID_PASSWORD', 'Current password is incorrect.', 401);
    }

if ($adminModel->verifyPassword($newPassword, $admin['password_hash'])) {
        json_error('SAME_PASSWORD', 'New password must be different from the current password.', 422);
    }

$adminModel->update($adminId, ['password' => $newPassword], $adminId);

json_success(['success' => true]);
} catch (Exception $e) {
    json_error('SERVER_ERROR', $e->getMessage(), 500);
}

CANCEL

Name	Type	Size	Modified	Actions
↩ ..	DIR	—	—
📄 change-password.php	PHP	1.9 KB	2026-07-03 12:03	EDIT
📄 error_log	?	2.3 KB	2026-08-21 18:50	EDIT
📄 login.php	PHP	1.7 KB	2026-07-02 10:29	EDIT
📄 refresh.php	PHP	1 KB	2026-07-02 10:29	EDIT