<?php 
// Security Headers
header("X-Frame-Options: SAMEORIGIN"); // cegah clickjacking
header("X-Content-Type-Options: nosniff"); // cegah MIME sniffing
header("X-XSS-Protection: 1; mode=block"); // cegah XSS di browser lama
header("Referrer-Policy: no-referrer-when-downgrade"); // batasi info referrer
header("Content-Security-Policy: default-src 'self' https: data:; script-src 'self' https://cdn.jsdelivr.net https://cdnjs.cloudflare.com; style-src 'self' https://cdn.jsdelivr.net https://fonts.googleapis.com 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' https://fonts.gstatic.com;"); 
?>

<?php
session_start();
include '../config.php';


$id = $_GET['id'];
$data = $conn->query("SELECT * FROM promo WHERE id=$id")->fetch_assoc();

if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $judul = $_POST['judul'];
    $deskripsi = $_POST['deskripsi'];

    if (!empty($_FILES['poster']['name'])) {
        $poster = $_FILES['poster']['name'];
        $target = "../uploads/" . basename($poster);
        move_uploaded_file($_FILES['poster']['tmp_name'], $target);
        $conn->query("UPDATE promo SET judul='$judul', deskripsi='$deskripsi', poster='$poster' WHERE id=$id");
    } else {
        $conn->query("UPDATE promo SET judul='$judul', deskripsi='$deskripsi' WHERE id=$id");
    }
    header("Location: promo.php");
}
?>

<!DOCTYPE html>
<html lang="id">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Edit Promo</title>
    <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css" rel="stylesheet">
</head>
<body class="bg-light">

<div class="container mt-5">
    <div class="card shadow-lg border-0">
        <div class="card-header bg-warning text-dark">
            <h4 class="mb-0">✏ Edit Promo Spesial</h4>
        </div>
        <div class="card-body">
            <form method="POST" enctype="multipart/form-data">
                <div class="mb-3">
                    <label class="form-label">Judul Promo</label>
                    <input type="text" name="judul" class="form-control" value="<?= $data['judul']; ?>" required>
                </div>

                <div class="mb-3">
                    <label class="form-label">Deskripsi</label>
                    <textarea name="deskripsi" class="form-control" rows="3" required><?= $data['deskripsi']; ?></textarea>
                </div>

                <div class="mb-3">
                    <label class="form-label">Poster Saat Ini</label><br>
                    <img src="../uploads/<?= $data['poster']; ?>" alt="Poster" width="150" class="rounded shadow mb-2">
                </div>

                <div class="mb-3">
                    <label class="form-label">Ganti Poster (opsional)</label>
                    <input type="file" name="poster" class="form-control" accept="image/*">
                </div>

                <div class="d-flex justify-content-between">
                    <a href="promo.php" class="btn btn-secondary">⬅ Kembali</a>
                    <button type="submit" class="btn btn-warning">💾 Simpan Perubahan</button>
                </div>
            </form>
        </div>
    </div>
</div>

<script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/js/bootstrap.bundle.min.js"></script>
</body>
</html>
