foto-portfolio/admin/settings.php

<?php
/**
 * Settings: admin password change plus the legal pages (Impressum /
 * Datenschutz), which are stored as basic Markdown in data/site.json.
 */
require dirname(__DIR__) . '/app/bootstrap.php';
auth_require();

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    csrf_verify();

    if (($_POST['section'] ?? '') === 'legal') {
        $site = site_get();
        $site['impressum']   = trim((string)($_POST['impressum'] ?? ''));
        $site['datenschutz'] = trim((string)($_POST['datenschutz'] ?? ''));
        site_save($site);
        flash_set('Legal pages saved.');
        redirect('settings.php');
    }

    $new = (string)($_POST['new_password'] ?? '');
    if ($new !== (string)($_POST['new_password2'] ?? '')) {
        flash_set('New passwords do not match.', 'error');
    } else {
        $err = auth_change_password((string)($_POST['current_password'] ?? ''), $new);
        flash_set($err ?? 'Password changed.', $err ? 'error' : 'ok');
    }
    redirect('settings.php');
}

$site = site_get();

admin_header('Settings', 'settings');
flash_render();
?>
<h1>Settings</h1>

<form method="post" class="card" style="max-width:26rem">
    <?= csrf_field() ?>
    <h2 style="margin-top:0">Change password</h2>
    <label for="c">Current password</label>
    <input type="password" id="c" name="current_password" autocomplete="current-password">
    <label for="n1">New password</label>
    <input type="password" id="n1" name="new_password" autocomplete="new-password">
    <label for="n2">Repeat new password</label>
    <input type="password" id="n2" name="new_password2" autocomplete="new-password">
    <p class="help">At least 8 characters. Written to config/credentials.php.</p>
    <button type="submit">Change password</button>
</form>

<form method="post" class="card">
    <?= csrf_field() ?>
    <input type="hidden" name="section" value="legal">
    <h2 style="margin-top:0">Legal pages</h2>
    <p class="help" style="margin-top:0">
        Basic Markdown is supported: <code># Heading</code>, <code>- list item</code>,
        <code>**bold**</code>, <code>*italic*</code>, <code>[text](https://…)</code>.
    </p>

    <label for="imp">Impressum <a href="../impressum.php" target="_blank" rel="noopener">view ↗</a></label>
    <textarea id="imp" name="impressum" style="min-height:14rem"><?= e($site['impressum'] ?? '') ?></textarea>

    <label for="dsg">Datenschutz <a href="../datenschutz.php" target="_blank" rel="noopener">view ↗</a></label>
    <textarea id="dsg" name="datenschutz" style="min-height:14rem"><?= e($site['datenschutz'] ?? '') ?></textarea>

    <button type="submit">Save legal pages</button>
</form>

<p class="help">
    Username and S3 settings are edited directly in the files under <code>config/</code>.
</p>
<?php admin_footer(); ?>