fix: remove served .bak leak, fix backup-block regex to cover .bak-* patterns, add .bak- to .gitignore

8c318f73c9cf9b40905ebbaa723e135b9b3cc724 · 2026-05-30 21:21:54 -0700 · SteveStudio2

- Deleted public/index.html.bak-20260526152130 which was being served publicly
- Fixed middleware regex \.bak\. -> \.bak[\-.] so .bak-TIMESTAMP filenames are blocked
- Added *.bak-* glob to .gitignore to prevent future timestamped backups from landing in git

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Files touched

M .gitignore
M server.js

Diff

commit 8c318f73c9cf9b40905ebbaa723e135b9b3cc724
Author: SteveStudio2 <stevestudio2@SteveStacStudio.lan>
Date:   Sat May 30 21:21:54 2026 -0700

    fix: remove served .bak leak, fix backup-block regex to cover .bak-* patterns, add *.bak-* to .gitignore
    
    - Deleted public/index.html.bak-20260526152130 which was being served publicly
    - Fixed middleware regex \.bak\. -> \.bak[\-.] so .bak-TIMESTAMP filenames are blocked
    - Added *.bak-* glob to .gitignore to prevent future timestamped backups from landing in git
    
    Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .gitignore | 1 +
 server.js  | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index b1d1347..45a3a95 100644
--- a/.gitignore
+++ b/.gitignore
@@ -26,6 +26,7 @@ out/
 # snapshot / backup files — never track
 *.bak
 *.bak.*
+*.bak-*
 *.pre-*
 *.orig
 public/index.html.pre-sort-frontend
diff --git a/server.js b/server.js
index 889ea78..6f4971d 100644
--- a/server.js
+++ b/server.js
@@ -150,7 +150,7 @@ require('./_universal-auth')(app, { siteName: "1980swallpaper" });
 
 // Block snapshot/backup files from ever serving out of the static root.
 app.use((req, res, next) => {
-  if (/\.(bak|pre-[\w.-]+|orig|tmp)$|\.bak\.|\.pre-/i.test(req.path)) return res.status(404).send('Not found');
+  if (/\.(bak|pre-[\w.-]+|orig|tmp)$|\.bak[\-.]|\.pre-/i.test(req.path)) return res.status(404).send('Not found');
   next();
 });

← e28149b security: strip hardcoded dw_admin DSN password -> env-first · back to 1980swallpaper · scrub residual 3rd-party vendor names from products.json sou b3e1a60 →