fix: remove leaked public bak file and fix 404 guard regex to block *.bak-TIMESTAMP patterns

3b01401c23e3f97c319338c5fa450a436f4f58f7 · 2026-05-30 21:34:29 -0700 · SteveStudio2

- Deleted public/index.html.bak-20260526152130 (was served as HTTP 200 — bypassed guard)
- Fixed 404-guard regex: .bak-* suffix was not matched; now catches .bak, .bak., .bak-*
- Added *.bak-* to .gitignore so timestamped backups are never tracked

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Files touched

M .gitignore
M server.js

Diff

commit 3b01401c23e3f97c319338c5fa450a436f4f58f7
Author: SteveStudio2 <stevestudio2@SteveStacStudio.lan>
Date:   Sat May 30 21:34:29 2026 -0700

    fix: remove leaked public bak file and fix 404 guard regex to block *.bak-TIMESTAMP patterns
    
    - Deleted public/index.html.bak-20260526152130 (was served as HTTP 200 — bypassed guard)
    - Fixed 404-guard regex: .bak-* suffix was not matched; now catches .bak, .bak., .bak-*
    - Added *.bak-* to .gitignore so timestamped backups are never tracked
    
    Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .gitignore | 1 +
 server.js  | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 469b831..bfce733 100644
--- a/.gitignore
+++ b/.gitignore
@@ -26,5 +26,6 @@ out/
 # snapshot / backup files — never tracked, never served
 *.bak
 *.bak.*
+*.bak-*
 *.pre-*
 *.orig
diff --git a/server.js b/server.js
index d63a1dc..fbf0922 100644
--- a/server.js
+++ b/server.js
@@ -151,7 +151,7 @@ require('./_universal-auth')(app, { siteName: "1900swallpaper" });
 
 // 404-guard: never serve snapshot/backup files from the static root
 app.use((req, res, next) => {
-  if (/\.(bak|pre-[^/]*)$|\.bak\.|\.pre-/i.test(req.path)) return res.status(404).send('Not found');
+  if (/\.(bak(-[^/]*)?|pre-[^/]*)$|\.bak[-.]|\.pre-/i.test(req.path)) return res.status(404).send('Not found');
   next();
 });

← 9891fc3 feat(fleet): theme1/theme2 query-param-gated toggle on catal · back to 1900swallpaper · facets counts now reflect q+tag filters, add legacy .html -> 8799439 →