foto-portfolio/public/admin/settings.php

<?php
/**
 * Settings: online admin password change (rewrites config/credentials.php).
 */
require dirname(__DIR__, 2) . '/app/bootstrap.php';
auth_require();

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    csrf_verify();
    $new = (string)($_POST['new_password'] ?? '');
    if ($new !== (string)($_POST['new_password2'] ?? '')) {
        flash_set('New passwords do not match.', 'error');
    } else {
        $err = auth_change_password((string)($_POST['current_password'] ?? ''), $new);
        flash_set($err ?? 'Password changed.', $err ? 'error' : 'ok');
    }
    redirect('settings.php');
}

admin_header('Settings', 'settings');
flash_render();
?>
<h1>Settings</h1>
<form method="post" class="card" style="max-width:26rem">
    <?= csrf_field() ?>
    <h2 style="margin-top:0">Change password</h2>
    <label for="c">Current password</label>
    <input type="password" id="c" name="current_password" autocomplete="current-password">
    <label for="n1">New password</label>
    <input type="password" id="n1" name="new_password" autocomplete="new-password">
    <label for="n2">Repeat new password</label>
    <input type="password" id="n2" name="new_password2" autocomplete="new-password">
    <p class="help">At least 8 characters. Written to config/credentials.php.</p>
    <button type="submit">Change password</button>
</form>
<p class="help">
    Username and S3 settings are edited directly in the files under <code>config/</code>.
</p>
<?php admin_footer(); ?>