<?php
 
// Security Headers
header("X-Frame-Options: SAMEORIGIN"); // cegah clickjacking
header("X-Content-Type-Options: nosniff"); // cegah MIME sniffing
header("X-XSS-Protection: 1; mode=block"); // cegah XSS di browser lama
header("Referrer-Policy: no-referrer-when-downgrade"); // batasi info referrer
header("Content-Security-Policy: default-src 'self' https: data:; script-src 'self' https://cdn.jsdelivr.net https://cdnjs.cloudflare.com; style-src 'self' https://cdn.jsdelivr.net https://fonts.googleapis.com 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' https://fonts.gstatic.com;"); 

include 'header.php';
include 'config.php';
$galeri = mysqli_query($conn, "SELECT * FROM galeri ORDER BY tanggal DESC");
?>

<!DOCTYPE html>
<html lang="id">
<head>
    <meta charset="UTF-8">
    <title>Galeri Kegiatan PT Psiko Dinamika</title>
    <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.2/dist/css/bootstrap.min.css" rel="stylesheet">
</head>
<body>
<div class="container py-5">
    <h1 class="fw-bold mb-4">Galeri Kegiatan</h1>
    <p style="text-align:justify; line-height:1.8;">
        Dokumentasi kegiatan ilmiah & edukatif yang sudah dilaksanakan PT Psiko Dinamika.
    </p>

    <div class="row">
        <?php while($row = mysqli_fetch_assoc($galeri)): ?>
        <div class="col-md-4 mb-4">
            <div class="card shadow-sm">
                <?php if ($row['foto']): ?>
                    <img src="uploads/galeri/<?= $row['foto'] ?>" class="card-img-top" alt="<?= htmlspecialchars($row['judul']) ?>">
                <?php endif; ?>
                <div class="card-body">
                    <h5 class="card-title"><?= htmlspecialchars($row['judul']) ?></h5>
                    <p class="text-muted"><?= date("d M Y", strtotime($row['tanggal'])) ?></p>
                    <p><?= htmlspecialchars($row['deskripsi']) ?></p>
                </div>
            </div>
        </div>
        <?php endwhile; ?>
    </div>
</div>
</body>
</html>

<?php include 'footer.php'; ?>