dashboard.php

<?php
// ============ HelpDesk Portal · dashboard ============
require __DIR__ . '/includes/functions.php';
$me = require_login();

$pdo = db();
$st  = $pdo->prepare('SELECT * FROM tickets WHERE user_id = ? ORDER BY id DESC');
$st->execute([(int)$me['id']]);
$tickets = $st->fetchAll();

page_header('Dashboard');
flash();
?>
<div class="card">
  <h2>Dashboard</h2>
  <p>Selamat datang, <b><?= e($me['username']) ?></b> (role: <?= e($me['role']) ?>).</p>
  <p>
    <a class="btn" href="/profile.php">Lihat / Edit Profil</a>
    <a class="btn" href="/create-ticket.php">Buat Ticket</a>
    <a class="btn" href="/tickets.php">Semua Ticket Saya</a>
  </p>
</div>

<div class="card">
  <h2>Security Research Lab</h2>
  <p class="muted"><b>Target:</b> HelpDesk Portal<br>
  <b>Objective:</b> identify unsafe handling of user-controlled HTML.</p>
  <p class="muted"><b>Questions (pikirkan, jangan di-answer di sini):</b></p>
  <ul class="muted">
    <li>1. Which parameters accept user-controlled input?</li>
    <li>2. Is the input reflected or stored?</li>
    <li>3. Where does the data go?</li>
    <li>4. Where is the data rendered?</li>
    <li>5. Is output encoding applied?</li>
    <li>6. Can another user see the injected content?</li>
    <li>7. Is JavaScript execution possible?</li>
  </ul>
</div>

<div class="card">
  <h2>Ticket Terbaru Saya</h2>
  <?php if (!$tickets): ?>
    <p class="muted">Belum ada ticket.</p>
  <?php else: foreach ($tickets as $t): ?>
    <div class="list-item">
      <h3>#<?= (int)$t['id'] ?> — <?= e($t['subject']) ?></h3>
      <span class="badge <?= e($t['status']) ?>"><?= e($t['status']) ?></span>
      <span class="muted small"> · <?= e($t['created_at']) ?></span><br>
      <a href="/ticket.php?id=<?= (int)$t['id'] ?>">Lihat ticket</a>
    </div>
  <?php endforeach; endif; ?>
</div>
<?php page_footer(); ?>