skyview.astronomiemuseum.de/public/settings.php

<?php
declare(strict_types=1);

ini_set('display_errors', '1');
error_reporting(E_ALL);
session_start();

if (!isset($_SESSION['user_id'])) {
    header('Location: login.php');
    exit;
}

$config = require __DIR__ . '/../config/database.php';

$dsn = sprintf(
    'mysql:host=%s;dbname=%s;charset=%s',
    $config['host'],
    $config['dbname'],
    $config['charset'] ?? 'utf8mb4'
);

$pdo = new PDO(
    $dsn,
    $config['user'],
    $config['pass'],
    [
        PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
        PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
    ]
);

$userId = (int) $_SESSION['user_id'];
$errors = [];
$successMessage = '';

function h(?string $value): string
{
    return htmlspecialchars((string) $value, ENT_QUOTES, 'UTF-8');
}

$stmtUser = $pdo->prepare("
    SELECT
        `id`,
        `username`,
        `email`,
        `display_name`,
        `role`,
        `is_active`
    FROM `app_users`
    WHERE `id` = :id
    LIMIT 1
");
$stmtUser->execute([':id' => $userId]);
$user = $stmtUser->fetch();

if (!$user) {
    $_SESSION = [];
    session_destroy();
    header('Location: login.php');
    exit;
}

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $action = $_POST['action'] ?? '';

    if ($action === 'update_profile') {
        $displayName = trim($_POST['display_name'] ?? '');
        $email = trim($_POST['email'] ?? '');

        if ($email === '' || !filter_var($email, FILTER_VALIDATE_EMAIL)) {
            $errors[] = 'Bitte eine gueltige E-Mail-Adresse eingeben.';
        }

        if ($displayName !== '' && mb_strlen($displayName) > 100) {
            $errors[] = 'Der Anzeigename darf maximal 100 Zeichen lang sein.';
        }

        if (empty($errors)) {
            $stmtCheck = $pdo->prepare("
                SELECT `id`
                FROM `app_users`
                WHERE `email` = :email
                  AND `id` <> :id
                LIMIT 1
            ");
            $stmtCheck->execute([
                ':email' => $email,
                ':id' => $userId,
            ]);

            if ($stmtCheck->fetch()) {
                $errors[] = 'Die E-Mail-Adresse ist bereits vergeben.';
            }
        }

        if (empty($errors)) {
            $stmtUpdate = $pdo->prepare("
                UPDATE `app_users`
                SET
                    `display_name` = :display_name,
                    `email` = :email,
                    `updated_at` = NOW()
                WHERE `id` = :id
            ");
            $stmtUpdate->execute([
                ':display_name' => $displayName !== '' ? $displayName : null,
                ':email' => $email,
                ':id' => $userId,
            ]);

            $_SESSION['display_name'] = $displayName !== '' ? $displayName : null;
            $successMessage = 'Die Kontodaten wurden gespeichert.';
        }
    }

    if ($action === 'change_password') {
        $currentPassword = $_POST['current_password'] ?? '';
        $newPassword = $_POST['new_password'] ?? '';
        $newPasswordRepeat = $_POST['new_password_repeat'] ?? '';

        $stmtPassword = $pdo->prepare("
            SELECT `password_hash`
            FROM `app_users`
            WHERE `id` = :id
            LIMIT 1
        ");
        $stmtPassword->execute([':id' => $userId]);
        $passwordRow = $stmtPassword->fetch();

        if (!$passwordRow || !password_verify($currentPassword, $passwordRow['password_hash'])) {
            $errors[] = 'Das aktuelle Passwort ist nicht korrekt.';
        }

        if ($newPassword === '') {
            $errors[] = 'Bitte ein neues Passwort eingeben.';
        } elseif (strlen($newPassword) < 8) {
            $errors[] = 'Das neue Passwort muss mindestens 8 Zeichen lang sein.';
        }

        if ($newPassword !== $newPasswordRepeat) {
            $errors[] = 'Die neuen Passwoerter stimmen nicht ueberein.';
        }

        if (empty($errors)) {
            $newHash = password_hash($newPassword, PASSWORD_DEFAULT);

            $stmtUpdatePassword = $pdo->prepare("
                UPDATE `app_users`
                SET
                    `password_hash` = :password_hash,
                    `updated_at` = NOW()
                WHERE `id` = :id
            ");
            $stmtUpdatePassword->execute([
                ':password_hash' => $newHash,
                ':id' => $userId,
            ]);

            $successMessage = 'Das Passwort wurde geaendert.';
        }
    }

    $stmtUser->execute([':id' => $userId]);
    $user = $stmtUser->fetch();
}

$loggedIn = true;
?>
<?php require __DIR__ . '/header.php'; ?>

<?php if ($successMessage !== ''): ?>
    <p class="msg-success"><?= h($successMessage) ?></p>
<?php endif; ?>

<?php if (!empty($errors)): ?>
    <ul class="msg-error">
        <?php foreach ($errors as $error): ?>
            <li><?= h($error) ?></li>
        <?php endforeach; ?>
    </ul>
<?php endif; ?>

<div class="grid-2">
    <div class="card">
        <h2>Kontodaten</h2>
        <table class="data-table mb-lg">
            <tr><td>Benutzername</td><td><?= h($user['username']) ?></td></tr>
            <tr><td>Rolle</td><td><?= h($user['role']) ?></td></tr>
        </table>
        <form method="post" action="" class="form-stack">
            <input type="hidden" name="action" value="update_profile">
            <div class="form-group">
                <label for="display_name">Anzeigename <span class="form-optional">(optional)</span></label>
                <input
                    type="text"
                    id="display_name"
                    name="display_name"
                    maxlength="100"
                    value="<?= h($user['display_name'] ?? '') ?>"
                >
            </div>
            <div class="form-group">
                <label for="email">E-Mail-Adresse</label>
                <input
                    type="email"
                    id="email"
                    name="email"
                    required
                    maxlength="190"
                    value="<?= h($user['email']) ?>"
                >
            </div>
            <button type="submit" class="btn btn-primary btn-full">Speichern</button>
        </form>
    </div>

    <div class="card">
        <h2>Passwort aendern</h2>
        <form method="post" action="" class="form-stack">
            <input type="hidden" name="action" value="change_password">
            <div class="form-group">
                <label for="current_password">Aktuelles Passwort</label>
                <input type="password" id="current_password" name="current_password" required>
            </div>
            <div class="form-group">
                <label for="new_password">Neues Passwort</label>
                <input type="password" id="new_password" name="new_password" required>
            </div>
            <div class="form-group">
                <label for="new_password_repeat">Neues Passwort wiederholen</label>
                <input type="password" id="new_password_repeat" name="new_password_repeat" required>
            </div>
            <button type="submit" class="btn btn-primary btn-full">Passwort aendern</button>
        </form>
    </div>
</div>

<?php require __DIR__ . '/footer.php'; ?>