<?php 
// Security Headers
header("X-Frame-Options: SAMEORIGIN"); // cegah clickjacking
header("X-Content-Type-Options: nosniff"); // cegah MIME sniffing
header("X-XSS-Protection: 1; mode=block"); // cegah XSS di browser lama
header("Referrer-Policy: no-referrer-when-downgrade"); // batasi info referrer
header("Content-Security-Policy: default-src 'self' https: data:; script-src 'self' https://cdn.jsdelivr.net https://cdnjs.cloudflare.com; style-src 'self' https://cdn.jsdelivr.net https://fonts.googleapis.com 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' https://fonts.gstatic.com;"); 
?>

<?php
session_start();
include '../config.php';



$result = $conn->query("SELECT * FROM promo");
?>

<!DOCTYPE html>
<html lang="id">
<head>
    <meta charset="UTF-8">
    <title>Manajemen Promo Spesial</title>
    <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css" rel="stylesheet">
</head>
<body class="p-4">

    <div class="container">
        <h2 class="mb-4">Manajemen Promo Spesial</h2>
        <a href="tambah_promo.php" class="btn btn-primary mb-3">+ Tambah Promo</a>
        <a href="dashboard.php" class="btn btn-secondary mb-3">⬅ Kembali </a>

        <table class="table table-bordered table-striped align-middle">
            <thead class="table-dark">
                <tr>
                    <th>Poster</th>
                    <th>Judul</th>
                    <th>Deskripsi</th>
                    <th style="width: 150px;">Aksi</th>
                </tr>
            </thead>
            <tbody>
                <?php while ($row = mysqli_fetch_assoc($result)) { ?>
                    <tr>
                        <td>
                            <img src="../uploads/<?php echo $row['poster']; ?>" 
                                 alt="<?php echo $row['judul']; ?>" 
                                 style="width:120px; height:auto;">
                        </td>
                        <td><?php echo $row['judul']; ?></td>
                        <td><?php echo $row['deskripsi']; ?></td>
                        <td>
                            <a href="edit_promo.php?id=<?php echo $row['id']; ?>" 
                               class="btn btn-warning btn-sm">Edit</a>
                            <a href="hapus_promo.php?id=<?php echo $row['id']; ?>" 
                               class="btn btn-danger btn-sm"
                               onclick="return confirm('Yakin hapus promo ini?');">Hapus</a>
                        </td>
                    </tr>
                <?php } ?>
            </tbody>
        </table>
    </div>

</body>
</html>