psa-orderform/admin/settings.php

<?php
require_once __DIR__ . "/../config.php";
require_once __DIR__ . "/../includes/functions.php";
require_once __DIR__ . "/../includes/version.php";
require_once __DIR__ . "/../manage-client/lib/client.php";

function settingsFormatBackupDate(string $date): string
{
    $timestamp = strtotime($date);
    if ($timestamp === false) {
        return $date;
    }

    return date("d.m.Y H:i", $timestamp);
}

function settingsIsSuperAdmin(): bool
{
    return normalizeAdminUsername($_SESSION['admin_username'] ?? "") === "admin";
}

function settingsGetLocalConfigPath(): string
{
    return dirname(__DIR__) . "/config.php";
}

function settingsReadLocalConfig(): string
{
    $path = settingsGetLocalConfigPath();
    if (!is_file($path) || !is_readable($path)) {
        return "";
    }

    $content = file_get_contents($path);
    return $content === false ? "" : $content;
}

function settingsWriteLocalConfig(string $content): void
{
    $content = str_replace("\r\n", "\n", $content);

    if (!str_starts_with(ltrim($content), "<?php")) {
        throw new RuntimeException('Die Konfiguration muss mit "<?php" beginnen.');
    }

    try {
        token_get_all($content, TOKEN_PARSE);
    } catch (ParseError $parseError) {
        throw new RuntimeException("PHP-Syntaxfehler: " . $parseError->getMessage());
    }

    $path = settingsGetLocalConfigPath();
    $tmpFile = $path . ".tmp";

    if (file_put_contents($tmpFile, $content, LOCK_EX) === false) {
        throw new RuntimeException("Konfiguration konnte nicht geschrieben werden.");
    }

    $backupDir = DATA_DIR . "backups/config/";
    if (!is_dir($backupDir) && !mkdir($backupDir, 0775, true) && !is_dir($backupDir)) {
        @unlink($tmpFile);
        throw new RuntimeException("Sicherungsverzeichnis konnte nicht angelegt werden.");
    }

    if (is_file($path)) {
        $backupPath = $backupDir . "config-" . date("Ymd-His") . ".php.bak";
        if (!copy($path, $backupPath)) {
            @unlink($tmpFile);
            throw new RuntimeException("Sicherung der bestehenden Konfiguration ist fehlgeschlagen.");
        }
    }

    @chmod($tmpFile, 0664);
    if (!rename($tmpFile, $path)) {
        @unlink($tmpFile);
        throw new RuntimeException("Konfiguration konnte nicht gespeichert werden.");
    }

    if (function_exists("opcache_invalidate")) {
        opcache_invalidate($path, true);
    }
}

if (empty($_SESSION['admin_logged_in'])) {
    header("Location: login.php");
    exit();
}

$pageTitle = "Einstellungen";
$message = "";
$messageType = "";
$isSuperAdmin = settingsIsSuperAdmin();

if ($_SERVER['REQUEST_METHOD'] === "POST" && isset($_POST['save_settings'])) {
    // Validate CSRF token
    if (!validateCsrfToken($_POST['csrf_token'] ?? "")) {
        $message = "Ungültiges Token. Bitte versuchen Sie es erneut.";
        $messageType = "error";
    } else {
        $settings = array_merge(getSystemSettings(), [
            "order_recipient_email" => $_POST['order_recipient_email'] ?? "",
            "attach_order_pdf_to_admin_email" => isset(
                $_POST['attach_order_pdf_to_admin_email'],
            ),
            "nametag_product_name" => $_POST['nametag_product_name'] ?? "",
        ]);

        if (saveSystemSettings($settings)) {
            logAccess("Admin updated system settings");
            $message = "Einstellungen wurden gespeichert.";
            $messageType = "success";
        } else {
            $message = "Einstellungen konnten nicht gespeichert werden.";
            $messageType = "error";
        }
    }
} elseif ($_SERVER['REQUEST_METHOD'] === "POST" && isset($_POST['save_local_config'])) {
    if (!$isSuperAdmin) {
        http_response_code(403);
        $message = "Keine Berechtigung für diese Aktion.";
        $messageType = "error";
    } elseif (!validateCsrfToken($_POST['csrf_token'] ?? "")) {
        $message = "Ungültiges Token. Bitte versuchen Sie es erneut.";
        $messageType = "error";
    } else {
        try {
            settingsWriteLocalConfig((string) ($_POST['local_config_content'] ?? ""));
            logAccess("Admin updated local config.php");
            $message = "Lokale Konfiguration wurde gespeichert.";
            $messageType = "success";
        } catch (Throwable $exception) {
            $message = "Konfiguration konnte nicht gespeichert werden: " . $exception->getMessage();
            $messageType = "error";
        }
    }
} elseif ($_SERVER['REQUEST_METHOD'] === "POST" && isset($_POST['add_category'])) {
    if (!validateCsrfToken($_POST['csrf_token'] ?? "")) {
        $message = "Ungültiges Token. Bitte versuchen Sie es erneut.";
        $messageType = "error";
    } else {
        $categories = getCategories();
        $label = normalizeCategoryLabel($_POST['category_label'] ?? "");

        if (!isValidCategoryLabel($label)) {
            $message = "Bitte geben Sie einen Kategorienamen mit maximal 80 Zeichen ein.";
            $messageType = "error";
        } else {
            $categoryId = generateCategoryIdFromLabel($label, $categories);
            $categories[] = [
                "id" => $categoryId,
                "label" => $label,
            ];
            if (saveCategories($categories)) {
                logAccess("Admin added category", [
                    "category_id" => $categoryId,
                    "label" => $label,
                ]);
                $message = "Kategorie wurde erfolgreich angelegt.";
                $messageType = "success";
            } else {
                $message = "Kategorie konnte nicht gespeichert werden.";
                $messageType = "error";
            }
        }
    }
} elseif ($_SERVER['REQUEST_METHOD'] === "POST" && isset($_POST['update_category'])) {
    if (!validateCsrfToken($_POST['csrf_token'] ?? "")) {
        $message = "Ungültiges Token. Bitte versuchen Sie es erneut.";
        $messageType = "error";
    } else {
        $categories = getCategories();
        $categoryId = normalizeCategoryId($_POST['category_id'] ?? "");
        $label = normalizeCategoryLabel($_POST['category_label'] ?? "");
        $found = false;

        if (!isValidCategoryLabel($label)) {
            $message = "Bitte geben Sie einen Kategorienamen mit maximal 80 Zeichen ein.";
            $messageType = "error";
        } else {
            foreach ($categories as &$category) {
                if ($category["id"] === $categoryId) {
                    $category["label"] = $label;
                    $found = true;
                    break;
                }
            }
            unset($category);

            if (!$found) {
                $message = "Kategorie nicht gefunden.";
                $messageType = "error";
            } elseif (saveCategories($categories)) {
                logAccess("Admin updated category", [
                    "category_id" => $categoryId,
                    "label" => $label,
                ]);
                $message = "Kategorie wurde erfolgreich aktualisiert.";
                $messageType = "success";
            } else {
                $message = "Kategorie konnte nicht gespeichert werden.";
                $messageType = "error";
            }
        }
    }
} elseif ($_SERVER['REQUEST_METHOD'] === "POST" && isset($_POST['delete_category'])) {
    if (!validateCsrfToken($_POST['csrf_token'] ?? "")) {
        $message = "Ungültiges Token. Bitte versuchen Sie es erneut.";
        $messageType = "error";
    } else {
        $categoryId = normalizeCategoryId($_POST['category_id'] ?? "");
        $label = "";
        $found = false;

        if (isCategoryInUse($categoryId)) {
            $message =
                "Diese Kategorie wird noch von Produkten verwendet und kann nicht gelöscht werden.";
            $messageType = "error";
        } else {
            $categories = array_values(
                array_filter(getCategories(), function ($category) use (
                    $categoryId,
                    &$found,
                    &$label,
                ) {
                    if ($category["id"] === $categoryId) {
                        $found = true;
                        $label = $category["label"];
                        return false;
                    }
                    return true;
                }),
            );

            if (!$found) {
                $message = "Kategorie nicht gefunden.";
                $messageType = "error";
            } elseif (saveCategories($categories)) {
                logAccess("Admin deleted category", [
                    "category_id" => $categoryId,
                    "label" => $label,
                ]);
                $message = "Kategorie wurde gelöscht.";
                $messageType = "success";
            } else {
                $message = "Kategorie konnte nicht gelöscht werden.";
                $messageType = "error";
            }
        }
    }
} elseif ($_SERVER['REQUEST_METHOD'] === "POST" && isset($_POST['save_faq'])) {
    if (!validateCsrfToken($_POST['csrf_token'] ?? "")) {
        $message = "Ungültiges Token. Bitte versuchen Sie es erneut.";
        $messageType = "error";
    } else {
        $content = isset($_POST['content']) ? (string) $_POST['content'] : "";
        $faqSettings = array_merge(getSystemSettings(), [
            "startpage_intro_text" => isset($_POST['startpage_intro_text'])
                ? (string) $_POST['startpage_intro_text']
                : "",
        ]);

        if (saveFaqContent($content) && saveSystemSettings($faqSettings)) {
            logAccess("Admin updated FAQ content");
            $message = "FAQ-Inhalt und Startseitentext wurden gespeichert.";
            $messageType = "success";
        } else {
            $message = "FAQ-Inhalt und/oder Startseitentext konnten nicht gespeichert werden.";
            $messageType = "error";
        }
    }
} elseif ($_SERVER['REQUEST_METHOD'] === "POST" && isset($_POST['add_organization'])) {
    if (!validateCsrfToken($_POST['csrf_token'] ?? "")) {
        $message = "Ungültiges Token. Bitte versuchen Sie es erneut.";
        $messageType = "error";
    } else {
        $organizations = getOrganizations(false);
        $label = normalizeOrganizationLabel($_POST['organization_label'] ?? "");
        $sortOrder = (int) ($_POST['sort_order'] ?? 0);
        $active = isset($_POST['active']);

        if (!isValidOrganizationLabel($label)) {
            $message = "Bitte einen Organisationsnamen mit maximal 120 Zeichen eingeben.";
            $messageType = "error";
        } else {
            $orgId = generateOrganizationIdFromLabel($label, $organizations);
            $organizations[] = [
                "id" => $orgId,
                "label" => $label,
                "sort_order" => $sortOrder,
                "active" => $active,
            ];
            if (saveOrganizations($organizations)) {
                logAccess("Admin added organization", [
                    "org_id" => $orgId,
                    "label" => $label,
                ]);
                $message = "Organisation wurde angelegt.";
                $messageType = "success";
            } else {
                $message = "Organisation konnte nicht gespeichert werden.";
                $messageType = "error";
            }
        }
    }
} elseif ($_SERVER['REQUEST_METHOD'] === "POST" && isset($_POST['update_organization'])) {
    if (!validateCsrfToken($_POST['csrf_token'] ?? "")) {
        $message = "Ungültiges Token. Bitte versuchen Sie es erneut.";
        $messageType = "error";
    } else {
        $organizations = getOrganizations(false);
        $organizationId = normalizeOrganizationId($_POST['organization_id'] ?? "");
        $label = normalizeOrganizationLabel($_POST['organization_label'] ?? "");
        $sortOrder = (int) ($_POST['sort_order'] ?? 0);
        $active = isset($_POST['active']);
        $updated = false;

        if (!isValidOrganizationLabel($label)) {
            $message = "Bitte einen Organisationsnamen mit maximal 120 Zeichen eingeben.";
            $messageType = "error";
        } else {
            foreach ($organizations as &$organization) {
                if ($organization["id"] !== $organizationId) {
                    continue;
                }

                $organization["label"] = $label;
                $organization["sort_order"] = $sortOrder;
                $organization["active"] = $active;
                $updated = true;
                break;
            }
            unset($organization);

            if (!$updated) {
                $message = "Organisation nicht gefunden.";
                $messageType = "error";
            } elseif (saveOrganizations($organizations)) {
                logAccess("Admin updated organization", [
                    "org_id" => $organizationId,
                    "label" => $label,
                ]);
                $message = "Organisation wurde aktualisiert.";
                $messageType = "success";
            } else {
                $message = "Organisation konnte nicht gespeichert werden.";
                $messageType = "error";
            }
        }
    }
} elseif ($_SERVER['REQUEST_METHOD'] === "POST" && isset($_POST['delete_organization'])) {
    if (!validateCsrfToken($_POST['csrf_token'] ?? "")) {
        $message = "Ungültiges Token. Bitte versuchen Sie es erneut.";
        $messageType = "error";
    } else {
        $organizationId = normalizeOrganizationId($_POST['organization_id'] ?? "");
        $orgLabel = "";
        foreach (getOrganizations(false) as $organization) {
            if ($organization["id"] === $organizationId) {
                $orgLabel = $organization["label"];
                break;
            }
        }
        $organizations = array_values(
            array_filter(getOrganizations(false), function ($organization) use (
                $organizationId,
            ) {
                return $organization["id"] !== $organizationId;
            }),
        );
        if (saveOrganizations($organizations)) {
            logAccess("Admin deleted organization", [
                "org_id" => $organizationId,
                "label" => $orgLabel,
            ]);
            $message = "Organisation wurde gelöscht.";
            $messageType = "success";
        } else {
            $message = "Organisation konnte nicht gelöscht werden.";
            $messageType = "error";
        }
    }
}

$settings = getSystemSettings();
$manageStatus = manageClientStatus();
$localConfigContent = $isSuperAdmin ? settingsReadLocalConfig() : "";

$categories = getCategories();
$products = getProducts();
$organizations = getOrganizations(false);
$faqContent = getFaqContent();
$startpageIntroText = (string) ($settings["startpage_intro_text"] ?? "");

$editCategoryId = normalizeCategoryId($_GET['edit_category'] ?? "");
$editingCategory = null;
if ($editCategoryId !== "") {
    $editingCategory = getCategoryById($editCategoryId);
    if ($editingCategory === null && $message === "") {
        $message = "Ausgewählte Kategorie wurde nicht gefunden.";
        $messageType = "error";
    }
}

$editingOrganization = isset($_GET['edit_organization'])
    ? getOrganizationById($_GET['edit_organization'])
    : null;

$bodyClass = "admin-page";
include __DIR__ . "/../includes/header.php";
?>

<div class="admin-header">
    <h2>Einstellungen</h2>
    <div>
        <a href="index.php" class="btn btn-secondary">Zurück zum Dashboard</a>
    </div>
</div>

<?php if ($message !== ""): ?>
    <div class="alert alert-<?php echo escape($messageType); ?>">
        <?php echo escape($message); ?>
    </div>
<?php endif; ?>

<div class="panel panel-lg" id="kategorien">
    <h3>Kategorien</h3>
    <?php if ($editingCategory !== null): ?>
        <h4>Kategorie bearbeiten</h4>
        <form method="POST" action="settings.php#kategorien">
            <?php echo csrfField(); ?>
            <input type="hidden" name="category_id" value="<?php echo escape(
                $editingCategory["id"],
            ); ?>">
            <div class="form-group">
                <label for="category_id_display">ID</label>
                <input type="text" id="category_id_display" value="<?php echo escape(
                    $editingCategory["id"],
                ); ?>" readonly>
                <small>Die ID sollte gleichbleiben, damit Produktzuordnungen und Filter-URLs gültig bleiben.</small>
            </div>
            <div class="form-group">
                <label for="category_label_edit">Name *</label>
                <input type="text" id="category_label_edit" name="category_label" maxlength="80" required value="<?php echo escape(
                    $editingCategory["label"],
                ); ?>">
            </div>
            <button type="submit" name="update_category" class="btn">Kategorie aktualisieren</button>
            <a href="settings.php#kategorien" class="btn btn-secondary">Abbrechen</a>
        </form>
    <?php else: ?>
        <h4>Neue Kategorie anlegen</h4>
        <form method="POST" action="settings.php#kategorien">
            <?php echo csrfField(); ?>
            <div class="form-group">
                <label for="category_label">Name *</label>
                <input type="text" id="category_label" name="category_label" maxlength="80" required placeholder="z.B. Accessoires">
                <small>Die technische ID wird einmalig automatisch aus dem Namen erzeugt.</small>
            </div>
            <button type="submit" name="add_category" class="btn">Kategorie anlegen</button>
        </form>
    <?php endif; ?>

    <div class="table-responsive mt-4">
        <table class="responsive-table">
            <thead>
                <tr>
                    <th>Name</th>
                    <th>ID</th>
                    <th>Produkte</th>
                    <th>Aktionen</th>
                </tr>
            </thead>
            <tbody>
                <?php foreach ($categories as $category): ?>
                    <?php
                    $productCount = 0;
                    foreach ($products as $product) {
                        if (productHasCategory($product, $category["id"])) {
                            $productCount++;
                        }
                    }
                    ?>
                    <tr>
                        <td data-label="Name"><?php echo escape(
                            $category["label"],
                        ); ?></td>
                        <td data-label="ID"><code><?php echo escape(
                            $category["id"],
                        ); ?></code></td>
                        <td data-label="Produkte"><?php echo $productCount; ?></td>
                        <td data-label="Aktionen">
                            <a href="settings.php?edit_category=<?php echo urlencode(
                                $category["id"],
                            ); ?>#kategorien" class="btn btn-small btn-secondary">Bearbeiten</a>
                            <form method="POST" action="settings.php#kategorien" class="inline-form" onsubmit="return confirm('Kategorie wirklich löschen?');">
                                <?php echo csrfField(); ?>
                                <input type="hidden" name="category_id" value="<?php echo escape(
                                    $category["id"],
                                ); ?>">
                                <button type="submit" name="delete_category" class="btn btn-small">Löschen</button>
                            </form>
                        </td>
                    </tr>
                <?php endforeach; ?>
            </tbody>
        </table>
    </div>
</div>

<div class="panel panel-lg mt-4" id="faq">
    <h3>FAQ</h3>
    <p class="mb-2">
        Unterstützte Markdown-Syntax: <code>#</code>, <code>##</code>, <code>###</code>, <code>**fett**</code>, <code>*kursiv*</code>, Listen mit <code>-</code> oder <code>1.</code>, Links mit <code>[Text](https://example.com)</code>
    </p>

    <form method="POST" action="settings.php#faq">
        <?php echo csrfField(); ?>
        <div class="form-group">
            <label for="content">FAQ-Inhalt (Markdown)</label>
            <textarea id="content" name="content" rows="18"><?php echo escape(
                $faqContent,
            ); ?></textarea>
        </div>
        <div class="form-group">
            <label for="startpage_intro_text">Startseitentext</label>
            <textarea id="startpage_intro_text" name="startpage_intro_text" rows="6"><?php echo escape(
                $startpageIntroText,
            ); ?></textarea>
        </div>
        <button type="submit" name="save_faq" class="btn">Speichern</button>
    </form>
</div>

<div class="panel panel-lg mt-4" id="organisationen">
    <h3>Organisationen</h3>
    <h4><?php echo $editingOrganization
        ? "Organisation bearbeiten"
        : "Neue Organisation"; ?></h4>
    <form method="POST" action="settings.php#organisationen">
        <?php echo csrfField(); ?>
        <?php if ($editingOrganization): ?>
            <input type="hidden" name="organization_id" value="<?php echo escape(
                $editingOrganization["id"],
            ); ?>">
        <?php endif; ?>

        <div class="form-group">
            <label for="organization_label">Name *</label>
            <input type="text" id="organization_label" name="organization_label" required maxlength="120" value="<?php echo escape(
                $editingOrganization["label"] ?? "",
            ); ?>">
        </div>

        <div class="form-group">
            <label for="sort_order">Sortierung</label>
            <input type="number" id="sort_order" name="sort_order" value="<?php echo escape(
                (string) ($editingOrganization["sort_order"] ?? 0),
            ); ?>">
        </div>

        <div class="form-group">
            <label>
                <input type="checkbox" name="active" value="1" <?php echo !isset(
                    $editingOrganization["active"],
                ) || !empty($editingOrganization["active"])
                    ? "checked"
                    : ""; ?>>
                Organisation ist auswählbar
            </label>
        </div>

        <button type="submit" name="<?php echo $editingOrganization
            ? "update_organization"
            : "add_organization"; ?>" class="btn">
            <?php echo $editingOrganization
                ? "Speichern"
                : "Organisation anlegen"; ?>
        </button>
        <?php if ($editingOrganization): ?>
            <a href="settings.php#organisationen" class="btn btn-secondary">Abbrechen</a>
        <?php endif; ?>
    </form>

    <div class="table-responsive mt-4">
        <table class="responsive-table">
            <thead>
                <tr>
                    <th>Name</th>
                    <th>ID</th>
                    <th>Sortierung</th>
                    <th>Status</th>
                    <th>Aktionen</th>
                </tr>
            </thead>
            <tbody>
                <?php foreach ($organizations as $organization): ?>
                    <tr>
                        <td data-label="Name"><?php echo escape(
                            $organization["label"],
                        ); ?></td>
                        <td data-label="ID"><code><?php echo escape(
                            $organization["id"],
                        ); ?></code></td>
                        <td data-label="Sortierung"><?php echo (int) $organization[
                            "sort_order"
                        ]; ?></td>
                        <td data-label="Status">
                            <span class="status <?php echo !empty(
                                $organization["active"]
                            )
                                ? "status-open"
                                : "status-cancelled"; ?>">
                                <?php echo !empty($organization["active"])
                                    ? "Aktiv"
                                    : "Inaktiv"; ?>
                            </span>
                        </td>
                        <td data-label="Aktionen">
                            <a href="settings.php?edit_organization=<?php echo urlencode(
                                $organization["id"],
                            ); ?>#organisationen" class="btn btn-small">Bearbeiten</a>
                            <form method="POST" action="settings.php#organisationen" class="inline-form" onsubmit="return confirm('Organisation wirklich löschen?');">
                                <?php echo csrfField(); ?>
                                <input type="hidden" name="organization_id" value="<?php echo escape(
                                    $organization["id"],
                                ); ?>">
                                <button type="submit" name="delete_organization" class="btn btn-secondary btn-small">Löschen</button>
                            </form>
                        </td>
                    </tr>
                <?php endforeach; ?>
            </tbody>
        </table>
    </div>
</div>

<div class="panel panel-lg mt-4" id="allgemein">
    <h3>Allgemein</h3>
    <form method="POST" action="settings.php#allgemein">
        <?php echo csrfField(); ?>
        <div class="form-group">
            <label for="order_recipient_email">Empfängeradresse für interne Bestellungen *</label>
            <input type="email" id="order_recipient_email" name="order_recipient_email" required value="<?php echo escape(
                $settings["order_recipient_email"],
            ); ?>">
        </div>

        <div class="form-group">
            <label class="checkbox-label">
                <input type="checkbox" name="attach_order_pdf_to_admin_email" value="1" <?php echo !empty(
                    $settings["attach_order_pdf_to_admin_email"]
                )
                    ? "checked"
                    : ""; ?>>
                PDF an interne Bestell-E-Mails anhängen
            </label>
        </div>

        <div class="form-group">
            <label for="nametag_product_name">Artikelname für Namensschilder *</label>
            <input type="text" id="nametag_product_name" name="nametag_product_name" required value="<?php echo escape(
                $settings["nametag_product_name"],
            ); ?>">
            <small>Muss exakt dem Produktnamen im Katalog entsprechen. Wird von der Namensschilder-Übersicht verwendet.</small>
        </div>

        <button type="submit" name="save_settings" class="btn">Speichern</button>
    </form>
</div>

<div class="panel panel-lg mt-4" id="update-backup">
    <h3>Update &amp; Backup</h3>
    <p>Installierte Version: <?php echo escape($manageStatus["version"] !== "" ? $manageStatus["version"] : "unbekannt"); ?></p>
    <?php if (!$manageStatus["configured"]): ?>
        <p>Der Manage-Client ist nicht konfiguriert. <code>manage-client/config.php</code> fehlt oder ist unvollständig.</p>
    <?php elseif ($manageStatus["update"] !== null && $manageStatus["update"]["available"]): ?>
        <p>Update verfügbar: <?php echo escape($manageStatus["update"]["latest"]); ?></p>
    <?php elseif ($manageStatus["update"] !== null): ?>
        <p>Kein Update verfügbar.</p>
    <?php else: ?>
        <p>Update-Status konnte nicht geladen werden<?php echo $manageStatus["update_error"] !== null
            ? ": " . escape($manageStatus["update_error"])
            : "."; ?></p>
    <?php endif; ?>
    <p>
        Letztes Backup:
        <?php echo $manageStatus["last_backup_at"] !== null
            ? escape(settingsFormatBackupDate($manageStatus["last_backup_at"]))
            : "noch keines"; ?>
        (<?php echo count($manageStatus["backups"]); ?> lokal)
    </p>
    <?php if ($manageStatus["pending_migrations"] !== []): ?>
        <p><?php echo count($manageStatus["pending_migrations"]); ?> offene Migration(en).</p>
    <?php endif; ?>
    <p><a href="manage.php" class="btn btn-secondary">Update &amp; Backup öffnen</a></p>
</div>

<?php if ($isSuperAdmin): ?>
<div class="panel panel-lg mt-4" id="konfiguration">
    <h3>Lokale Konfiguration</h3>
    <p>Bearbeitet <code>config.php</code> direkt auf diesem Server. Diese Datei wird beim Update nicht überschrieben.</p>
    <div class="alert alert-warning">Vor dem Speichern wird die PHP-Syntax geprüft und die vorherige Version automatisch gesichert. Fehlerhafte Änderungen können die gesamte Anwendung lahmlegen.</div>
    <form method="POST" action="settings.php#konfiguration">
        <?php echo csrfField(); ?>
        <div class="form-group">
            <label for="local_config_content">Inhalt von config.php</label>
            <textarea id="local_config_content" name="local_config_content" rows="24" class="config-editor" spellcheck="false"><?php echo escape(
                $localConfigContent,
            ); ?></textarea>
        </div>
        <button type="submit" name="save_local_config" class="btn">Speichern</button>
    </form>
</div>
<?php endif; ?>

<?php include __DIR__ . "/../includes/footer.php"; ?>