<?php
/**
 * 修改密码
 */

$error = '';
$success = false;

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    requireMemberCsrfToken();
    $old_password = trim($_POST['old_password'] ?? '');
    $new_password = trim($_POST['new_password'] ?? '');
    $confirm_password = trim($_POST['confirm_password'] ?? '');

    if (empty($old_password) || empty($new_password)) {
        $error = '请填写所有密码字段';
    } elseif ($new_password !== $confirm_password) {
        $error = '两次输入的新密码不一致';
    } elseif (strlen($new_password) < 6) {
        $error = '新密码长度不能少于6位';
    } else {
        $m = $db->fetch("SELECT password FROM {$db->table('member')} WHERE id = ?", [$_SESSION['member_id']]);

        if (!password_verify($old_password, $m['password']) && md5($old_password) !== $m['password']) {
            $error = '原密码错误';
        } else {
            $db->update('member', [
                'password' => password_hash($new_password, PASSWORD_DEFAULT),
                'update_time' => time()
            ], 'id = ?', [$_SESSION['member_id']]);
            $success = true;
        }
    }
}
?>
<div class="page-header">
    <h1 class="page-title">
        <i class="icon-lock"></i>
        修改密码
    </h1>
</div>
<div class="page-content">
    <?php if ($error): ?>
    <div class="alert alert-error"><?php echo htmlspecialchars($error); ?></div>
    <?php endif; ?>

    <?php if ($success): ?>
    <div class="alert alert-success">✓ 密码修改成功</div>
    <?php endif; ?>

    <form method="post" class="password-form">
        <input type="hidden" name="csrf_token" value="<?php echo htmlspecialchars(getMemberCsrfToken()); ?>">
        <div class="form-group">
            <label>原密码</label>
            <input type="password" name="old_password" class="form-control" required>
        </div>

        <div class="form-group">
            <label>新密码</label>
            <input type="password" name="new_password" class="form-control" required placeholder="至少6位">
        </div>

        <div class="form-group">
            <label>确认新密码</label>
            <input type="password" name="confirm_password" class="form-control" required placeholder="再次输入新密码">
        </div>

        <div class="form-actions">
            <button type="submit" class="btn btn-primary">确认修改</button>
        </div>
    </form>
</div>
<style>
.password-form { max-width: 500px; }
.form-actions { margin-top: 24px; }
.alert {
    padding: 12px 16px;
    border-radius: 8px;
    font-size: 14px;
    margin-bottom: 20px;
}
.alert-error { background: #fee2e2; color: #dc2626; }
.alert-success { background: #d1fae5; color: #059669; }
</style>
