fix: remove leaked public/index.html.bak, harden bak guard regex, add .bak- to .gitignore

4b8dc702cc5c97ae120ba1c3f4c3f3dcd9bf55cd · 2026-05-30 21:33:42 -0700 · SteveStudio2

- Deleted public/index.html.bak-20260526152130 which was being served as 200 via express.static
- Extended server.js bak-guard regex from \.(bak)(\.|$) to \.(bak)([.\-]|$) so .bak-TIMESTAMP filenames are also blocked
- Added *.bak-* and *.orig to .gitignore so date-stamped editor backups are never committed

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Files touched

M .gitignore
M server.js

Diff

commit 4b8dc702cc5c97ae120ba1c3f4c3f3dcd9bf55cd
Author: SteveStudio2 <stevestudio2@SteveStacStudio.lan>
Date:   Sat May 30 21:33:42 2026 -0700

    fix: remove leaked public/index.html.bak, harden bak guard regex, add *.bak-* to .gitignore
    
    - Deleted public/index.html.bak-20260526152130 which was being served as 200 via express.static
    - Extended server.js bak-guard regex from \.(bak)(\.|$) to \.(bak)([.\-]|$) so .bak-TIMESTAMP filenames are also blocked
    - Added *.bak-* and *.orig to .gitignore so date-stamped editor backups are never committed
    
    Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .gitignore | 2 ++
 server.js  | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 913246e..c4b703f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -25,4 +25,6 @@ venv/
 out/
 *.bak
 *.bak.*
+*.bak-*
 *.pre-*
+*.orig
diff --git a/server.js b/server.js
index 638d9fe..7f74e32 100644
--- a/server.js
+++ b/server.js
@@ -162,7 +162,7 @@ require("./_universal-contact")(app, cfg.contact);
 require("./_universal-auth")(app, cfg.auth);
 // Guard: never serve editor/snapshot artifacts (*.bak, *.bak.*, *.pre-*) from static root.
 app.use((req, res, next) => {
-  if (/\.(bak)(\.|$)|\.pre-/i.test(req.path)) return res.status(404).send('Not found');
+  if (/\.(bak)([.\-]|$)|\.pre-|\.orig$/i.test(req.path)) return res.status(404).send('Not found');
   next();
 });
 app.use(express.static(path.join(__dirname, 'public')));

← b14e81f feat(fleet): theme1/theme2 query-param-gated toggle on catal · back to Agedwallpaper · facets: count over filtered result set (drill-down via share dc13558 →