code
d1ce803412
Bug fixes: - Deleting a user with comments no longer 500s: remove the user's comments first (covers old DBs) and add ON DELETE CASCADE to the FK. - Drop 'svg' from the default media upload allowlist (stored-XSS vector for files served directly from public/uploads/). - Content index now reindexes on page deletion: track routable page count in content_index_meta and treat a count change as stale, since the newest-mtime check alone can't see a removal. - Dev router (public/router.php) preserves the query string across the canonical trailing-slash redirect, matching .htaccess. - Fix stale worked-example reference in the comments thread partial. Migrations: since v2 is unreleased with no live databases, fold the incremental ALTERs into the base migrations rather than shipping them separately: verification columns into 0002_create_users.sql, source_count into 0001_create_content_index.sql; renumber comments to 0003. Update all code/doc references to the removed/renamed files. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
_ __ _____ ____ _ ___ ___ _ __ (_)_ _ _ __ ___
| '_ \ / _ \ \ / / _` |/ __/ _ \| '_ \| | | | | '_ ` _ \
| | | | (_) \ V / (_| | (_| (_) | | | | | |_| | | | | | |
|_| |_|\___/ \_/ \__,_|\___\___/|_| |_|_|\__,_|_| |_| |_|
novaconium
A tiny, Hugo-flavored PHP micro-framework. Routes are directories on disk, pages render with Twig, and any page that needs real logic gets an optional PHP "sidecar" file. Pages without a sidecar are pre-rendered once and served as static HTML straight from Apache afterwards. No Composer — Twig is vendored directly into the repo as plain source files.
For a full tour of what's included — routing, sidecars, caching, admin auth, access control, media manager, database, search, RSS, and more — see the Novaconium Features post once the site is running, or /admin/docs (see Documentation below).
Getting started
Requirements: PHP 8.1+ (uses readonly constructor-promoted properties) and, for production, Apache with mod_rewrite and AllowOverride All. A few optional features (database, content index/search, admin authentication) need the pdo_sqlite extension — see /admin/docs for details once running.
Run it locally, no Apache needed:
php -S 127.0.0.1:8000 -t public public/router.php
Visit http://127.0.0.1:8000/ — click around the example pages, then open http://127.0.0.1:8000/admin/docs for the complete documentation, rendered live from this same instance.
Documentation
The full framework documentation lives inside the framework itself, at /admin/docs on any running instance — so it travels with the code, no internet connection needed. That's the canonical reference for everything: requirements, running locally, deploying on Apache or Docker, starting a new project, updating the framework, adding a page, routing, sidecars, libraries, database, session, content index, XML sitemap, RSS feeds, layouts, static caching, SEO, Matomo analytics, admin authentication, access control, draft pages, media manager, styling, and project layout.
AGENTS.md is the short, agent-facing version for coding assistants working in this repo, and novaconium/ISSUES.md is the roadmap/backlog.
Third-party
Twig is vendored in source form under novaconium/vendor/twig/ (no Composer — see /admin/docs/upgrading-twig for how to upgrade it). It's BSD-3-Clause licensed; the full license text ships alongside it at novaconium/vendor/twig/LICENSE.