<?php 
// Security Headers
header("X-Frame-Options: SAMEORIGIN"); // cegah clickjacking
header("X-Content-Type-Options: nosniff"); // cegah MIME sniffing
header("X-XSS-Protection: 1; mode=block"); // cegah XSS di browser lama
header("Referrer-Policy: no-referrer-when-downgrade"); // batasi info referrer
header("Content-Security-Policy: default-src 'self' https: data:; script-src 'self' https://cdn.jsdelivr.net https://cdnjs.cloudflare.com; style-src 'self' https://cdn.jsdelivr.net https://fonts.googleapis.com 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' https://fonts.gstatic.com;"); 
?>

<?php
session_start();
include '../config.php';


if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $judul = $_POST['judul'];
    $deskripsi = $_POST['deskripsi'];

    $poster = $_FILES['poster']['name'];
    $target = "../uploads/" . basename($poster);

    if (move_uploaded_file($_FILES['poster']['tmp_name'], $target)) {
        $conn->query("INSERT INTO promo (judul, deskripsi, poster) VALUES ('$judul', '$deskripsi', '$poster')");
        header("Location: promo.php");
    } else {
        echo "Upload gagal!";
    }
}
?>

<!DOCTYPE html>
<html lang="id">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Tambah Promo</title>
    <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css" rel="stylesheet">
</head>
<body class="bg-light">

<div class="container mt-5">
    <div class="card shadow-lg border-0">
        <div class="card-header bg-primary text-white">
            <h4 class="mb-0">Tambah Promo Spesial</h4>
        </div>
        <div class="card-body">
            <form method="POST" enctype="multipart/form-data">
                <div class="mb-3">
                    <label class="form-label">Judul Promo</label>
                    <input type="text" name="judul" class="form-control" placeholder="Masukkan judul promo" required>
                </div>

                <div class="mb-3">
                    <label class="form-label">Deskripsi</label>
                    <textarea name="deskripsi" class="form-control" rows="3" placeholder="Masukkan deskripsi promo" required></textarea>
                </div>

                <div class="mb-3">
                    <label class="form-label">Poster</label>
                    <input type="file" name="poster" class="form-control" accept="image/*" required>
                </div>

                <div class="d-flex justify-content-between">
                    <a href="promo.php" class="btn btn-secondary">⬅ Kembali</a>
                    <button type="submit" class="btn btn-primary">+ Tambah Promo</button>
                </div>
            </form>
        </div>
    </div>
</div>

<script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/js/bootstrap.bundle.min.js"></script>
</body>
</html>
