fix: remove public backup file leak + harden 404-guard to block .bak-* timestamp patterns

62de93bb43cc3c1501fc921d3dbfaca522afb733 · 2026-05-30 21:33:37 -0700 · SteveStudio2

- Deleted public/index.html.bak-20260526152130 (was served publicly; 200 response)
- Fixed 404-guard regex: .bak-TIMESTAMP pattern was not matched; now blocks .bak, .bak.*, .bak-* all variants
- Added *.bak-* to .gitignore so future timestamp-suffixed backups are excluded

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Files touched

M .gitignore
M server.js

Diff

commit 62de93bb43cc3c1501fc921d3dbfaca522afb733
Author: SteveStudio2 <stevestudio2@SteveStacStudio.lan>
Date:   Sat May 30 21:33:37 2026 -0700

    fix: remove public backup file leak + harden 404-guard to block .bak-* timestamp patterns
    
    - Deleted public/index.html.bak-20260526152130 (was served publicly; 200 response)
    - Fixed 404-guard regex: .bak-TIMESTAMP pattern was not matched; now blocks .bak, .bak.*, .bak-* all variants
    - Added *.bak-* to .gitignore so future timestamp-suffixed backups are excluded
    
    Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .gitignore | 1 +
 server.js  | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index a29cfed..af820c9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -26,5 +26,6 @@ out/
 # editor/snapshot backups — never track or serve these
 *.bak
 *.bak.*
+*.bak-*
 *.pre-*
 *~
diff --git a/server.js b/server.js
index de9a210..3bcc150 100644
--- a/server.js
+++ b/server.js
@@ -151,7 +151,7 @@ require('./_universal-auth')(app, { siteName: "1970swallpaper" });
 
 // 404-guard: never serve editor/snapshot backups from the static root.
 app.use((req, res, next) => {
-  if (/\.(bak|pre-[^/]*)(\.|$)|~$/i.test(req.path)) return res.status(404).send('Not found');
+  if (/\.(bak([-.][^/]*)?|pre-[^/]*)(\.|$)|~$/i.test(req.path)) return res.status(404).send('Not found');
   next();
 });

← d0c0159 feat(fleet): theme1/theme2 query-param-gated toggle on catal · back to 1970swallpaper · Add .html→clean-URL 301 redirects (care/history/sourcing/tra 67f0d06 →