← back to 1920swallpaper

fix: block .bak-* backup file leaks from express.static

75245157d133e2046b92d09cb5582c6fb2262094 · 2026-05-30 21:34:07 -0700 · SteveStudio2

- Delete public/index.html.bak-20260526152130 (leaked 200 via express.static)
- Fix 404-guard regex: \.(bak|orig)(\.|$) missed bak-TIMESTAMP filenames; updated to \.(bak(-[^/]*)?|orig)(\.|$)
- Add *.bak-* pattern to .gitignore to prevent future timestamped bak files from being committed

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Files touched

• M .gitignore
• M server.js

Diff

commit 75245157d133e2046b92d09cb5582c6fb2262094
Author: SteveStudio2 <stevestudio2@SteveStacStudio.lan>
Date:   Sat May 30 21:34:07 2026 -0700

    fix: block .bak-* backup file leaks from express.static
    
    - Delete public/index.html.bak-20260526152130 (leaked 200 via express.static)
    - Fix 404-guard regex: \.(bak|orig)(\.|$) missed bak-TIMESTAMP filenames; updated to \.(bak(-[^/]*)?|orig)(\.|$)
    - Add *.bak-* pattern to .gitignore to prevent future timestamped bak files from being committed
    
    Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .gitignore | 1 +
 server.js  | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 8585971..7b51037 100644
--- a/.gitignore
+++ b/.gitignore
@@ -26,6 +26,7 @@ out/
 # editor / refactor snapshot files — never commit
 *.bak
 *.bak.*
+*.bak-*
 *.pre-*
 *.orig
 *~
diff --git a/server.js b/server.js
index a46ced9..e11042e 100644
--- a/server.js
+++ b/server.js
@@ -150,7 +150,7 @@ require('./_universal-auth')(app, { siteName: "1920swallpaper" });
 
 // 404-guard: never serve editor/refactor snapshot files from the static root.
 app.use((req, res, next) => {
-  if (/\.(bak|orig)(\.|$)|\.pre-/i.test(req.path)) return res.status(404).send('Not found');
+  if (/\.(bak(-[^/]*)?|orig)(\.|$)|\.pre-/i.test(req.path)) return res.status(404).send('Not found');
   next();
 });
 

← ceaec19 feat(fleet): theme1/theme2 query-param-gated toggle on catal  ·  back to 1920swallpaper  ·  fix /api/facets to count the filtered result set, not the wh ca80344 →