fix: remove public bak file leak and extend bak-guard regex to cover .bak-TIMESTAMP pattern

82db56d59a3c29f3f773d7ea5c83a2b9091bb887 · 2026-05-30 21:31:08 -0700 · Steve Abrams

- Deleted public/index.html.bak-20260526152130 (was served as HTTP 200)
- Middleware regex \.bak(\.|$) missed .bak-TIMESTAMP files; extended to \.bak([.\-]|$)
- Added *.bak-* to .gitignore (was missing alongside *.bak and *.bak.*)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Files touched

M .gitignore
M server.js

Diff

commit 82db56d59a3c29f3f773d7ea5c83a2b9091bb887
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sat May 30 21:31:08 2026 -0700

    fix: remove public bak file leak and extend bak-guard regex to cover .bak-TIMESTAMP pattern
    
    - Deleted public/index.html.bak-20260526152130 (was served as HTTP 200)
    - Middleware regex \.bak(\.|$) missed .bak-TIMESTAMP files; extended to \.bak([.\-]|$)
    - Added *.bak-* to .gitignore (was missing alongside *.bak and *.bak.*)
    
    Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .gitignore | 1 +
 server.js  | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 1140724..3a7a026 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,4 +11,5 @@ build/
 .next/
 *.bak
 *.bak.*
+*.bak-*
 *.pre-*
diff --git a/server.js b/server.js
index b7a572e..112da62 100644
--- a/server.js
+++ b/server.js
@@ -147,7 +147,7 @@ require('./_universal-auth')(app, { siteName: "fabricwallpaper" });
 
 // Never serve snapshot/backup files from the static root.
 app.use((req, res, next) => {
-  if (/(\.bak(\.|$)|\.pre-)/i.test(req.path)) return res.status(404).send('Not found');
+  if (/(\.bak([.\-]|$)|\.pre-)/i.test(req.path)) return res.status(404).send('Not found');
   next();
 });

← 6a9eea9 feat(fleet): theme1/theme2 query-param-gated toggle on catal · back to Fabricwallpaper · Harden corner-nav window.open with noopener,noreferrer b3cc21f →