<?php 
// Security Headers
header("X-Frame-Options: SAMEORIGIN"); // cegah clickjacking
header("X-Content-Type-Options: nosniff"); // cegah MIME sniffing
header("X-XSS-Protection: 1; mode=block"); // cegah XSS di browser lama
header("Referrer-Policy: no-referrer-when-downgrade"); // batasi info referrer
header("Content-Security-Policy: default-src 'self' https: data:; script-src 'self' https://cdn.jsdelivr.net https://cdnjs.cloudflare.com; style-src 'self' https://cdn.jsdelivr.net https://fonts.googleapis.com 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' https://fonts.gstatic.com;"); 
?>

<?php
include '../config.php'; // koneksi


// Proses Tambah Event
if (isset($_POST['tambah'])) {
    $judul = $_POST['judul'];
    $tanggal = $_POST['tanggal'];
    $lokasi = $_POST['lokasi'];
    $deskripsi = $_POST['deskripsi'];

    // Upload Poster
    $poster = "";
    if (!empty($_FILES["poster"]["name"])) {
        $targetDir = "../uploads/";
        if (!is_dir($targetDir)) {
            mkdir($targetDir, 0777, true);
        }
        $poster = time() . "_" . basename($_FILES["poster"]["name"]);
        $targetFile = $targetDir . $poster;
        move_uploaded_file($_FILES["poster"]["tmp_name"], $targetFile);
    }

    mysqli_query($conn, "INSERT INTO event (judul, tanggal, lokasi, deskripsi, poster) 
                         VALUES ('$judul','$tanggal','$lokasi','$deskripsi','$poster')");
    header("Location: event.php");
    exit;
}

// Proses Edit Event
if (isset($_POST['edit'])) {
    $id = $_POST['id'];
    $judul = $_POST['judul'];
    $tanggal = $_POST['tanggal'];
    $lokasi = $_POST['lokasi'];
    $deskripsi = $_POST['deskripsi'];

    $sql = "UPDATE event SET judul='$judul', tanggal='$tanggal', lokasi='$lokasi', deskripsi='$deskripsi'";

    if (!empty($_FILES["poster"]["name"])) {
        $targetDir = "../uploads/";
        $poster = time() . "_" . basename($_FILES["poster"]["name"]);
        $targetFile = $targetDir . $poster;
        move_uploaded_file($_FILES["poster"]["tmp_name"], $targetFile);

        $sql .= ", poster='$poster'";
    }

    $sql .= " WHERE id=$id";
    mysqli_query($conn, $sql);

    header("Location: event.php");
    exit;
}

// Proses Hapus Event
if (isset($_GET['hapus'])) {
    $id = $_GET['hapus'];
    mysqli_query($conn, "DELETE FROM event WHERE id=$id");
    header("Location: event.php");
    exit;
}

// Ambil data event
$events = mysqli_query($conn, "SELECT * FROM event ORDER BY tanggal DESC");
?>

<!DOCTYPE html>
<html lang="id">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <title>Tambah Event</title>
    <!-- Bootstrap CSS -->
    <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.2/dist/css/bootstrap.min.css" rel="stylesheet">
</head>
<body class="bg-light">

<div class="container mt-5">
    <div class="card shadow rounded-3">
        <div class="card-header bg-primary text-white fw-bold fs-5">
            📅 Tambah Event
        </div>
        <div class="card-body">
            

    <!-- Form Tambah -->
    <form action="" method="post" enctype="multipart/form-data" class="mb-4">
        <input type="text" name="judul" placeholder="Judul" required class="form-control mb-2">
        <input type="date" name="tanggal" required class="form-control mb-2">
        <input type="text" name="lokasi" placeholder="Lokasi" required class="form-control mb-2">
        <textarea name="deskripsi" placeholder="Deskripsi" class="form-control mb-2"></textarea>
        <input type="file" name="poster" class="form-control mb-2">
        <button type="submit" name="tambah" class="btn btn-primary mb-3">💾 Simpan Event</button>
        <a href="dashboard.php" class="btn btn-secondary mb-3">⬅ Kembali </a>
    </form>

    <!-- Tabel Data Event -->
    <table class="table table-bordered">
        <thead class="table-dark">
            <tr>
                <th>Poster</th>
                <th>Judul</th>
                <th>Tanggal</th>
                <th>Lokasi</th>
                <th>Deskripsi</th>
                <th>Aksi</th>
            </tr>
        </thead>
        <tbody>
        <?php while($row = mysqli_fetch_assoc($events)): ?>
            <tr>
                <td>
                    <?php if ($row['poster']): ?>
                        <img src="../uploads/<?= $row['poster'] ?>" width="100">
                    <?php endif; ?>
                </td>
                <td><?= htmlspecialchars($row['judul']) ?></td>
                <td><?= htmlspecialchars($row['tanggal']) ?></td>
                <td><?= htmlspecialchars($row['lokasi']) ?></td>
                <td><?= htmlspecialchars($row['deskripsi']) ?></td>
                <td>
                    <a href="?hapus=<?= $row['id'] ?>" onclick="return confirm('Hapus event ini?')" class="btn btn-danger btn-sm">Hapus</a>
                    <!-- Form Edit -->
                    <form action="" method="post" enctype="multipart/form-data" style="margin-top:5px;">
                        <input type="hidden" name="id" value="<?= $row['id'] ?>">
                        <input type="text" name="judul" value="<?= htmlspecialchars($row['judul']) ?>" required class="form-control mb-1">
                        <input type="date" name="tanggal" value="<?= $row['tanggal'] ?>" required class="form-control mb-1">
                        <input type="text" name="lokasi" value="<?= htmlspecialchars($row['lokasi']) ?>" required class="form-control mb-1">
                        <textarea name="deskripsi" class="form-control mb-1"><?= htmlspecialchars($row['deskripsi']) ?></textarea>
                        <input type="file" name="poster" class="form-control mb-1">
                        <button type="submit" name="edit" class="btn btn-warning btn-sm">Edit</button>
                    </form>
                </td>
            </tr>
        <?php endwhile; ?>
        </tbody>
    </table>
</body>
</html>
