fix: remove public .bak snapshot + fix guard regex to block .bak-* timestamped files

3abdac08495ddf30abbbf1f95cb5bca2a9e17808 · 2026-05-30 21:30:11 -0700 · Steve Abrams

- Deleted public/index.html.bak-20260526152130 (was leaking via express.static since guard regex missed .bak-<timestamp> patterns)
- Fixed bak-guard middleware regex: now matches .bak-YYYYMMDD* in addition to plain .bak and .pre-* patterns
- Updated package-lock.json (npm install)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Files touched

M package-lock.json
M server.js

Diff

commit 3abdac08495ddf30abbbf1f95cb5bca2a9e17808
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sat May 30 21:30:11 2026 -0700

    fix: remove public .bak snapshot + fix guard regex to block .bak-* timestamped files
    
    - Deleted public/index.html.bak-20260526152130 (was leaking via express.static since guard regex missed .bak-<timestamp> patterns)
    - Fixed bak-guard middleware regex: now matches .bak-YYYYMMDD* in addition to plain .bak and .pre-* patterns
    - Updated package-lock.json (npm install)
    
    Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 package-lock.json | 13 +++++++++++++
 server.js         |  2 +-
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/package-lock.json b/package-lock.json
index c6b5ec1..5a818db 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -8,6 +8,7 @@
       "name": "hospitalitywallpaper",
       "version": "0.1.0",
       "dependencies": {
+        "dotenv": "^17.4.2",
         "express": "^4.21.0",
         "helmet": "^8.1.0"
       }
@@ -172,6 +173,18 @@
         "npm": "1.2.8000 || >= 1.4.16"
       }
     },
+    "node_modules/dotenv": {
+      "version": "17.4.2",
+      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-17.4.2.tgz",
+      "integrity": "sha512-nI4U3TottKAcAD9LLud4Cb7b2QztQMUEfHbvhTH09bqXTxnSie8WnjPALV/WMCrJZ6UV/qHJ6L03OqO3LcdYZw==",
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://dotenvx.com"
+      }
+    },
     "node_modules/dunder-proto": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
diff --git a/server.js b/server.js
index 5e70eca..7a23a43 100644
--- a/server.js
+++ b/server.js
@@ -153,7 +153,7 @@ require('./_universal-auth')(app, { siteName: "hospitalitywallpaper" });
 // Defense-in-depth: never serve backup snapshots even if one ever lands in
 // public/. Returns 404 before express.static gets a chance.
 app.use((req, res, next) => {
-  if (/\.(bak|pre-[\w-]+)(\.\w+)?$/i.test(req.path) || /\.pre-/.test(req.path)) {
+  if (/\.(bak|bak-[\w-]+)(\.\w+)?$/i.test(req.path) || /\.pre-/.test(req.path) || /\.(pre-[\w-]+)(\.\w+)?$/i.test(req.path)) {
     return res.status(404).send('Not found');
   }
   next();

← 32bf70f feat(fleet): theme1/theme2 query-param-gated toggle on catal · back to Hospitalitywallpaper · facets: count over the active filtered set via shared filter c601a13 →