omsorg/mitarbeiter-app/actions/save-profile.php

<?php
require_once __DIR__ . '/../lib/auth.php';
require_login();

$action   = $_POST['action'] ?? '';
$username = current_username();

if ($action === 'profile') {
    $email   = trim($_POST['email'] ?? '');
    $telefon = trim($_POST['telefon'] ?? '');

    if ($email !== '' && !filter_var($email, FILTER_VALIDATE_EMAIL)) {
        header('Location: ../pages/settings.php?error=' . urlencode('Ungültige E-Mail-Adresse.'));
        exit;
    }

    $stmt = db()->prepare('UPDATE users SET email = ?, telefon = ? WHERE username = ?');
    $stmt->execute([$email, $telefon, $username]);

    header('Location: ../pages/settings.php?saved=1');
    exit;
}

if ($action === 'password') {
    $old    = $_POST['old_password'] ?? '';
    $new    = $_POST['new_password'] ?? '';
    $repeat = $_POST['new_password_repeat'] ?? '';

    $user = current_user();

    if (!$user || !password_verify($old, $user['password_hash'])) {
        header('Location: ../pages/settings.php?error=' . urlencode('Aktuelles Passwort ist falsch.'));
        exit;
    }
    if (mb_strlen($new) < 8) {
        header('Location: ../pages/settings.php?error=' . urlencode('Neues Passwort muss mindestens 8 Zeichen haben.'));
        exit;
    }
    if ($new !== $repeat) {
        header('Location: ../pages/settings.php?error=' . urlencode('Die neuen Passwörter stimmen nicht überein.'));
        exit;
    }

    $hash = password_hash($new, PASSWORD_BCRYPT, ['cost' => 12]);
    $stmt = db()->prepare('UPDATE users SET password_hash = ? WHERE username = ?');
    $stmt->execute([$hash, $username]);

    header('Location: ../pages/settings.php?pwchanged=1');
    exit;
}

header('Location: ../pages/settings.php');
exit;