getMessage()));
exit;
}
}
http_response_code(404);
render_404($missingPath);
exit;
}
if (empty($_GET['new'])) {
render_history_redirect();
exit;
}
$newSlug = Notebook::create();
header('Location: ' . base_path() . '/index.php/' . rawurlencode($newSlug), true, 302);
exit;
}
if (!Slug::isValid($slug)) {
http_response_code(404);
render_404();
exit;
}
$nb = Notebook::get($slug);
if ($nb === null) {
if (is_create_missing_request()) {
try {
Notebook::createWithSlug($slug);
redirect_to_current_path();
} catch (InvalidArgumentException $e) {
http_response_code(400);
render_404($slug, path_create_error($e->getMessage()));
exit;
}
}
http_response_code(404);
render_404($slug);
exit;
}
Auth::startSession();
$locked = $nb['has_password'] && empty($_SESSION['unlocked'][$slug]);
$bootstrap = [
'slug' => $slug,
'hasPassword' => (bool) $nb['has_password'],
'locked' => $locked,
'csrf' => Auth::csrfToken(),
'tabs' => [],
'activeTab' => null,
];
if (!$locked) {
$tabs = Tab::listMeta($slug);
$bootstrap['tabs'] = $tabs;
if (!empty($tabs)) {
$first = $tabs[0];
$targetTabId = (int) ($_GET['tab'] ?? 0);
if ($targetTabId <= 0 && $routeTabId !== null) {
$targetTabId = $routeTabId;
}
$full = $targetTabId > 0 ? Tab::get($slug, $targetTabId) : null;
if ($full === null) {
$full = Tab::get($slug, (int) $first['id']);
}
if ($full !== null) {
$bootstrap['activeTab'] = $full;
}
}
}
render_shell($slug, $locked, $bootstrap);
// ---------- helpers ----------
/** @return array{slug: ?string, tab_id: ?int, not_found?: bool, missing_path?: string} */
function route_target(): array
{
$pathInfo = $_SERVER['PATH_INFO'] ?? '';
if ($pathInfo !== '') {
$candidate = ltrim($pathInfo, '/');
$candidate = explode('/', $candidate)[0];
return route_candidate($candidate);
}
if (!empty($_GET['n']) && is_string($_GET['n'])) {
return ['slug' => $_GET['n'], 'tab_id' => null];
}
$uri = $_SERVER['REQUEST_URI'] ?? '/';
$path = parse_url($uri, PHP_URL_PATH) ?? '/';
$path = preg_replace('#^' . preg_quote(base_path(), '#') . '#', '', $path) ?? $path;
$path = ltrim($path, '/');
if ($path === '') {
return ['slug' => null, 'tab_id' => null];
}
if ($path === 'index.php') {
return ['slug' => null, 'tab_id' => null];
}
if (strncmp($path, 'index.php/', 10) === 0) {
$indexPath = substr($path, 10);
if ($indexPath !== '') {
return route_candidate(explode('/', $indexPath)[0]);
}
return ['slug' => null, 'tab_id' => null];
}
return route_candidate(explode('/', $path)[0]);
}
/** @return array{slug: ?string, tab_id: ?int, not_found?: bool, missing_path?: string} */
function route_candidate(string $candidate): array
{
$candidate = rawurldecode($candidate);
if ($candidate === '') {
return ['slug' => null, 'tab_id' => null];
}
if (Slug::isValid($candidate)) {
return ['slug' => $candidate, 'tab_id' => null];
}
$tab = Tab::findByPathSlug($candidate);
if ($tab !== null) {
return [
'slug' => (string) $tab['notebook_slug'],
'tab_id' => (int) $tab['id'],
];
}
return ['slug' => null, 'tab_id' => null, 'not_found' => true, 'missing_path' => $candidate];
}
function base_path(): string
{
$script = $_SERVER['SCRIPT_NAME'] ?? '/index.php';
$base = rtrim(str_replace('\\', '/', dirname($script)), '/');
return $base;
}
function asset_url(string $rel): string
{
$path = __DIR__ . DIRECTORY_SEPARATOR . str_replace('/', DIRECTORY_SEPARATOR, $rel);
$v = is_file($path) ? filemtime($path) : time();
return base_path() . '/' . ltrim($rel, '/') . '?v=' . $v;
}
function h(string $s): string
{
return htmlspecialchars($s, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
}
function is_create_missing_request(): bool
{
return ($_SERVER['REQUEST_METHOD'] ?? 'GET') === 'POST'
&& isset($_POST['create_missing'])
&& hash_equals('1', (string) $_POST['create_missing']);
}
function redirect_to_current_path(): void
{
$uri = $_SERVER['REQUEST_URI'] ?? (base_path() . '/index.php');
$path = parse_url($uri, PHP_URL_PATH);
header('Location: ' . ($path ?: base_path() . '/index.php'), true, 303);
exit;
}
function path_create_error(string $code): string
{
return [
'bad_path' => '路径只能使用 2-64 位字母、数字、下划线或短横线。',
'reserved_path' => '这个路径与系统入口、随机地址或现有文件冲突。',
'path_taken' => '这个路径已经被其他 Tab 使用。',
'bad_slug' => '这个地址格式无效。',
'slug_taken' => '这个地址已经被创建。',
][$code] ?? '创建失败，请换一个路径再试。';
}
function render_404(?string $slug = null, string $error = ''): void
{
header('Content-Type: text/html; charset=utf-8');
$slugDisplay = $slug !== null ? h($slug) : '';
$canCreate = $slug !== null
&& (Slug::isValid($slug) || Tab::validatePathSlug($slug) === null);
$createForm = $canCreate ? <<
HTML : '';
$errorHtml = $error !== '' ? '' . h($error) . '
' : '';
echo <<
未找到 · PHPNotePad
笔记本不存在
没有找到 {$slugDisplay}。
{$errorHtml}
{$createForm}
创建随机地址的新笔记本
HTML;
}
function render_history_redirect(): void
{
header('Content-Type: text/html; charset=utf-8');
$base = h(base_path());
$newUrl = h(base_path() . '/index.php?new=1');
echo <<
PHPNotePad
HTML;
}
function render_shell(string $slug, bool $locked, array $bootstrap): void
{
header('Content-Type: text/html; charset=utf-8');
$cdn = 'https://cdn.jsdelivr.net';
// Cloudflare Web Analytics beacon (auto-injected when site is behind CF with RUM on)
$cf = 'https://static.cloudflareinsights.com';
$cfApi = 'https://cloudflareinsights.com';
$csp = "default-src 'self'; "
. "script-src 'self' {$cdn} {$cf} 'unsafe-eval' 'unsafe-inline'; "
. "style-src 'self' {$cdn} 'unsafe-inline'; "
. "font-src {$cdn} data:; "
. "img-src 'self' data: blob:; "
. "connect-src 'self' {$cdn} {$cfApi}; "
. "worker-src blob:;";
header('Content-Security-Policy: ' . $csp);
$appJs = asset_url('public/app.js');
$appCss = asset_url('public/app.css');
$baseHref = base_path() . '/';
$bootstrap['basePath'] = base_path();
$bootJson = json_encode($bootstrap, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE | JSON_HEX_TAG | JSON_HEX_AMP);
$csrfMeta = h($bootstrap['csrf']);
$baseAttr = h($baseHref);
$title = $locked ? '解锁笔记本' : 'PHPNotePad · ' . h($slug);
echo <<
{$title}
HTML;
if ($locked) {
echo <<
HTML;
return;
}
echo <<
HTML;
}