User Management
Create accounts, assign roles, and manage passwords. Access is role-based and enforced on every admin screen.
Roles
- Admin — full access to all modules and settings, and can manage other users.
- Staff — content access (pages, galleries, media) without system settings.
Add a user
- Open User Manager (System section) and click + Add User.
- Enter username, display name, email, and password.
- Choose the role, then Save.
Accounts are stored in admin/data/users.json; passwords are saved as bcrypt hashes, never plain text.
Reset a password
From the admin: open User Manager → Edit the user → enter a new password → Save. Changes apply on their next page load.
Emergency (no admin access): SSH in and generate a hash — php -r "echo password_hash('newpass', PASSWORD_BCRYPT).PHP_EOL;" — paste it into admin/data/users.json, then fix ownership: chown www-data:www-data admin/data/users.json. Any admin/data/ file edited as root must be returned to www-data or the CMS can’t write it.
Sessions & access
Login state uses PHP sessions: each device has its own, they time out after inactivity, and logging out ends the session immediately. Every module gates access at the top of its entry file, redirecting unauthenticated visitors to the login page and enforcing the required role.
Tips
Give people the lowest role that lets them do their job — Staff for content editors, Admin only for those who manage settings and users.