initial commit

api/user_reset_pw.php

@@ -0,0 +1,19 @@
+<?php
+ini_set('display_errors', 0);
+error_reporting(E_ALL);
+header('Content-Type: application/json; charset=utf-8');
+
+require_once __DIR__ . '/../config/config.php';
+session_start();
+
+if (!isset($_SESSION['loggedin']) || $_SESSION['loggedin'] !== true) { http_response_code(401); echo json_encode(['ok'=>false]); exit; }
+if (($_SESSION['role'] ?? 'user') !== 'admin') { http_response_code(403); echo json_encode(['ok'=>false]); exit; }
+
+$id = (int)($_POST['id'] ?? 0);
+if ($id <= 0) { http_response_code(400); echo json_encode(['ok'=>false,'error'=>'Missing id']); exit; }
+if ($id === (int)($_SESSION['id'] ?? 0)) { http_response_code(400); echo json_encode(['ok'=>false,'error'=>'Du kannst dein eigenes Passwort hier nicht resetten']); exit; }
+
+$st = $pdo->prepare("UPDATE users SET password_hash=NULL, first_login=1 WHERE id=:id");
+$st->execute([':id'=>$id]);
+
+echo json_encode(['ok'=>true]);