web app security fix

app/include_header.php

@@ -1,10 +1,7 @@
 <?php
 // Security headers — emitted before any HTML output.
-// X-Content-Type-Options: prevents MIME-sniffing attacks.
 header('X-Content-Type-Options: nosniff');
-// X-Frame-Options: blocks this page from being embedded in a cross-origin iframe.
 header('X-Frame-Options: SAMEORIGIN');
-// Referrer-Policy: sends origin only on same-origin; omits on cross-origin navigations.
 header('Referrer-Policy: strict-origin-when-cross-origin');
 ?>
 <!DOCTYPE html>
@@ -12,7 +9,7 @@ header('Referrer-Policy: strict-origin-when-cross-origin');
 
 <head>
   <meta charset="UTF-8" />
-  <title>TRx WMS</title>
+  <title>MN3 WMS</title>
   <meta name="csrf-token" content="<?= htmlspecialchars($_SESSION['csrf_token'] ?? '') ?>">
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <link rel="apple-touch-icon" sizes="180x180" href="<?php echo $server_url?>assets/images/favicon.png">
@@ -23,8 +20,14 @@ header('Referrer-Policy: strict-origin-when-cross-origin');
   <!-- jquery  -->
   <script src="https://code.jquery.com/jquery-3.7.1.js" integrity="sha256-eKhayi8LEQwp4NKxN+CfCh+3qOVUtJn3QNZ0TciWLP4=" crossorigin="anonymous"></script>
 
+  <!-- popper (must be before bootstrap) -->
+  <script src="https://cdn.jsdelivr.net/npm/@popperjs/core@2.11.8/dist/umd/popper.min.js" crossorigin="anonymous"></script>
+
   <!-- bootstrap  -->
   <script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.8/dist/js/bootstrap.min.js" integrity="sha384-G/EV+4j2dNv+tEPo3++6LCgdCROaejBqfUeNjuKAiuXbjrxilcCdDz6ZAVfHWe1Y" crossorigin="anonymous"></script>
+  <!-- Disable CDN Bootstrap's dropdown toggle — main.js bundles Bootstrap+Popper and
+       handles dropdown events. CDN Bootstrap stays for window.bootstrap (Modal API). -->
+  <script>bootstrap.Dropdown.prototype.toggle = function() {};</script>
 
   <!-- bootbox  -->
   <script src="https://cdnjs.cloudflare.com/ajax/libs/bootbox.js/4.4.0/bootbox.min.js"></script>
@@ -61,8 +64,6 @@ header('Referrer-Policy: strict-origin-when-cross-origin');
   
   <!-- theme script  -->
   <link rel="stylesheet" href="<?php echo $server_url?>assets/css/main.css">
-  <!-- Popper UMD: must load before main.js so window.Popper exists globally -->
-  <script src="https://cdn.jsdelivr.net/npm/@popperjs/core@2.11.8/dist/umd/popper.min.js" crossorigin="anonymous"></script>
   <script type="module" src="<?php echo $server_url?>assets/js/main.js"></script>
   <link rel="stylesheet" href="<?php echo $server_url?>assets/css/custom.css">
   <script src="<?php echo $server_url?>assets/js/custom.js"></script>