Yanz mini Shell

Action

[*] New File
[*] New Folder

Sensitive File

[*] /etc/passwd
[*] /etc/shadow
[*] /etc/resolv.conf

<?php
require_once __DIR__ . '/../config/config.php';
require_once __DIR__ . '/../includes/auth.php';
require_once __DIR__ . '/../includes/image_helper.php';
require_once 'includes/csrf.php';

requireAdmin();

$page_title = "Edit Berita";
$id = isset($_GET['id']) ? (int)$_GET['id'] : 0;

$stmt = $conn->prepare("SELECT * FROM news WHERE id = ?");
$stmt->bind_param("i", $id);
$stmt->execute();
$result = $stmt->get_result();
$row    = $result->fetch_assoc();
$stmt->close();

if (!$row) {
    header("Location: news-management.php");
    exit;
}

$error = '';

if (isset($_POST['update'])) {
    validateCSRFToken($_POST['csrf_token']);

$title    = trim($_POST['title']);
    $category = trim($_POST['category']);
    $content_input = trim($_POST['content']);
    $date     = $_POST['date_posted'];
    $image    = $row['image'];

if (isset($_FILES['image']) && $_FILES['image']['error'] !== UPLOAD_ERR_NO_FILE) {
        $upload = uploadGambar($_FILES['image'], __DIR__ . '/../assets/images/news/', 1600);
        if ($upload['success']) {
            // Hapus gambar lama
            if (!empty($row['image'])) {
                hapusGambar($row['image'], __DIR__ . '/../assets/images/news/');
            }
            $image = $upload['filename'];
        } else {
            $error = $upload['error'];
        }
    }

if (empty($error)) {
        $stmt = $conn->prepare("UPDATE news SET title=?, category=?, content=?, image=?, date_posted=? WHERE id=?");
        $stmt->bind_param("sssssi", $title, $category, $content_input, $image, $date, $id);
        if ($stmt->execute()) {
            logActivity('update_news', 'news', $id, "Edit berita: $title");

// Reset & re-tag dosen
            $conn->query("DELETE FROM berita_dosen WHERE berita_id = $id");
            if (!empty($_POST['dosen_ids']) && is_array($_POST['dosen_ids'])) {
                $tag = $conn->prepare("INSERT IGNORE INTO berita_dosen (berita_id, dosen_id) VALUES (?, ?)");
                foreach ($_POST['dosen_ids'] as $dosen_id) {
                    $dosen_id = (int)$dosen_id;
                    if ($dosen_id > 0) {
                        $tag->bind_param("ii", $id, $dosen_id);
                        $tag->execute();
                    }
                }
            }

$_SESSION['flash'] = ['message' => 'Berita berhasil diperbarui!', 'type' => 'success'];
            header("Location: news-management.php");
            exit;
        } else {
            $error = "Gagal memperbarui berita: " . $stmt->error;
        }
    }
}

$useTinyMCE = true;

// Daftar dosen + tag yang sudah ada
$dosen_options = $conn->query("SELECT id, nama, gelar_depan, gelar_belakang FROM dosen WHERE is_active = 1 ORDER BY nama");
$tagged = [];
$tq = $conn->prepare("SELECT dosen_id FROM berita_dosen WHERE berita_id = ?");
$tq->bind_param("i", $id);
$tq->execute();
foreach ($tq->get_result()->fetch_all(MYSQLI_ASSOC) as $t) $tagged[] = (int)$t['dosen_id'];

ob_start();
?>
<div class="max-w-4xl mx-auto bg-white rounded-3xl shadow-xl p-8">
  <h2 class="text-2xl font-bold mb-6">Edit Berita</h2>

<?php if ($error): ?>
    <div class="bg-red-100 text-red-700 p-4 rounded-2xl mb-6"><?= htmlspecialchars($error) ?></div>
  <?php endif; ?>

<?php if (!empty($row['image'])): ?>
    <div class="mb-6">
      <p class="text-sm font-medium mb-2">Gambar Saat Ini:</p>
      <img src="../assets/images/news/<?= htmlspecialchars($row['image']) ?>"
           class="max-w-md rounded-2xl border">
    </div>
  <?php endif; ?>

<div>
      <label class="block text-sm font-semibold mb-2">Judul Berita</label>
      <input type="text" name="title" value="<?= htmlspecialchars($row['title']) ?>"
             required maxlength="255" class="w-full px-5 py-4 border rounded-2xl">
    </div>

<div>
      <label class="block text-sm font-semibold mb-2">Kategori</label>
      <input type="text" name="category" value="<?= htmlspecialchars($row['category'] ?? '') ?>"
             required maxlength="100" class="w-full px-5 py-4 border rounded-2xl">
    </div>

<div>
      <label class="block text-sm font-semibold mb-2">Ganti Gambar <span class="text-gray-500">(Opsional)</span></label>
      <input type="file" name="image" accept="image/jpeg,image/png,image/webp"
             class="w-full px-5 py-4 border rounded-2xl">
      <p class="text-xs text-gray-500 mt-1">Biarkan kosong jika tidak ingin mengganti gambar</p>
    </div>

<div>
      <label class="block text-sm font-semibold mb-2">Isi Berita</label>
      <textarea name="content" rows="12" required class="editor w-full px-5 py-4 border rounded-2xl"><?= htmlspecialchars($row['content']) ?></textarea>
    </div>

<div>
      <label class="block text-sm font-semibold mb-2">Tanggal</label>
      <input type="date" name="date_posted" value="<?= htmlspecialchars($row['date_posted']) ?>"
             class="px-5 py-4 border rounded-2xl">
    </div>

<div>
      <label class="block text-sm font-semibold mb-2">
        <i class="fas fa-user-tag text-blue-500"></i> Tag Dosen Terkait (opsional)
      </label>
      <?php if ($dosen_options->num_rows === 0): ?>
        <p class="text-xs text-gray-500">Belum ada data dosen.</p>
      <?php else: ?>
        <div class="border rounded-2xl p-3 max-h-48 overflow-y-auto">
          <?php while ($do = $dosen_options->fetch_assoc()):
              $label = trim(($do['gelar_depan'] ? $do['gelar_depan'] . ' ' : '') . $do['nama'] . ($do['gelar_belakang'] ? ', ' . $do['gelar_belakang'] : ''));
              $checked = in_array($do['id'], $tagged) ? 'checked' : '';
          ?>
            <label class="flex items-center gap-2 py-1 text-sm cursor-pointer hover:bg-gray-50 px-2 rounded">
              <input type="checkbox" name="dosen_ids[]" value="<?= $do['id'] ?>" class="w-4 h-4" <?= $checked ?>>
              <?= htmlspecialchars($label) ?>
            </label>
          <?php endwhile; ?>
        </div>
        <p class="text-xs text-gray-500 mt-1">Berita akan otomatis muncul di profil dosen yang ditag.</p>
      <?php endif; ?>
    </div>

<button type="submit" name="update"
            class="w-full bg-[#00bfff] hover:bg-[#0099cc] text-white py-4 rounded-2xl font-semibold">
      Update Berita
    </button>
  </form>
</div>
<?php
$content = ob_get_clean();
include 'includes/admin_layout.php';