mirror of
https://github.com/ZHANGTIANYAO1/teamspeak-music-bot.git
synced 2026-10-02 04:52:50 +08:00
saopig1andClaude Opus 5
55695c2d1c
收藏机器人控制页时浏览器只显示空白页图标，移动端加到主屏幕也没有图标。 新增 web/public/：一个蓝底白色八分音符（配色取自 --color-primary #335eea） 的 favicon.svg，以及 16/32/48 三尺寸的 favicon.ico、180px 的 apple-touch-icon、 192/512 的 PNG 和一张 maskable 图标，配 site.webmanifest 供 Android 添加到 主屏幕使用。iOS 会自己裁圆角，所以 apple-touch-icon 是满幅方形。 放在 web/public/ 是因为 Vite 会原样复制到 dist 根目录，而 Express 已经在 serve web/dist（src/index.ts STATIC_DIR），静态资源又不在 /api 鉴权范围内， 所以登录页也能显示，无需改动服务端。同时补上真实的 /favicon.ico —— 没有它 时 SPA 兜底路由会对 /favicon.ico 返回 index.html 和 200，浏览器只会静默地 继续用空白图标。 theme-color 取深色主题的 --bg-primary（#222222）：前端默认深色且不跟随系统 配色（stores/player.ts）。 Closes #142 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
49 lines
2.9 KiB
HTML
49 lines
2.9 KiB
HTML
<!DOCTYPE html>
|
|
<html lang="zh-CN">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<!-- Keep deployed instances out of search-engine indexes (issue #128:
|
|
searching "TsmusicBot" surfaced strangers' WebUI URLs). Defence in depth
|
|
alongside the server's X-Robots-Tag header and /robots.txt. Applies to
|
|
the SPA shell and every in-app route (incl. /bot/<id> dedicated links),
|
|
since they all share this single index.html. -->
|
|
<meta name="robots" content="noindex, nofollow">
|
|
<!-- Bilibili / NetEase / QQ image CDNs reject requests whose Referer is not on
|
|
their whitelist, so we must not leak a Referer cross-origin. "same-origin"
|
|
does exactly that: full Referer for our own requests, none for cross-origin
|
|
ones — so cover thumbnails (<img> AND CSS background-image) still load.
|
|
Do NOT switch this back to "no-referrer": per the WHATWG Fetch spec
|
|
("Append a request Origin header") no-referrer downgrades the Origin header
|
|
to the literal string "null" on same-origin non-GET requests. The /api/*
|
|
CSRF guard (src/web/middleware/csrf.ts) then can't parse a host from it and
|
|
responds 403 "bad origin", silently breaking EVERY POST/PUT/DELETE — QR
|
|
login, cookie save, playback controls, bot management, user admin, etc.
|
|
"same-origin" keeps the real Origin on same-origin requests, so CSRF passes. -->
|
|
<meta name="referrer" content="same-origin">
|
|
<title>TSMusicBot</title>
|
|
<!-- Icons live in web/public/ so Vite copies them to the dist root, which is
|
|
what Express serves (src/index.ts STATIC_DIR). Both an .ico and an .svg
|
|
are declared: browsers that understand the vector one prefer it and stay
|
|
sharp on hi-dpi tabs, the rest fall back to the .ico. The .ico also
|
|
answers the implicit /favicon.ico request — without a real file there the
|
|
SPA catch-all hands back index.html with a 200, so the tab silently keeps
|
|
the blank-page icon (issue #142). -->
|
|
<link rel="icon" href="/favicon.ico" sizes="48x48">
|
|
<link rel="icon" href="/favicon.svg" type="image/svg+xml" sizes="any">
|
|
<!-- iOS home-screen icon; iOS masks the corners itself, so this one is a
|
|
full square. Android reads the manifest instead. -->
|
|
<link rel="apple-touch-icon" href="/apple-touch-icon.png">
|
|
<link rel="manifest" href="/site.webmanifest">
|
|
<!-- Matches --bg-primary of the dark theme, which is what the app starts in
|
|
(stores/player.ts defaults to 'dark' and never follows the OS scheme). -->
|
|
<meta name="theme-color" content="#222222">
|
|
<link rel="preconnect" href="https://fonts.googleapis.com">
|
|
<link href="https://fonts.googleapis.com/css2?family=Barlow:wght@400;500;600;700;800&display=swap" rel="stylesheet">
|
|
</head>
|
|
<body>
|
|
<div id="app"></div>
|
|
<script type="module" src="/src/main.ts"></script>
|
|
</body>
|
|
</html>
|