add 404-guard for .bak/.pre-* paths + clean-URL routes for /care /history /sourcing /trade /vocabulary

9e5968fcfe1d52dbedbe07df4a46d70d713b9635 · 2026-05-25 21:12:42 -0700 · Steve

Files touched

M server.js

Diff

commit 9e5968fcfe1d52dbedbe07df4a46d70d713b9635
Author: Steve <steve@designerwallcoverings.com>
Date:   Mon May 25 21:12:42 2026 -0700

    add 404-guard for .bak/.pre-* paths + clean-URL routes for /care /history /sourcing /trade /vocabulary
---
 server.js | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/server.js b/server.js
index 9883d93..5e70eca 100644
--- a/server.js
+++ b/server.js
@@ -150,8 +150,22 @@ app.use(express.json({ limit: '256kb' }));
 require('./_universal-contact')(app, { siteName: "Hospitality Wallpaper", zdColor: "#d4a847", zdPosition: 'right' });
 require('./_universal-auth')(app, { siteName: "hospitalitywallpaper" });
 
+// Defense-in-depth: never serve backup snapshots even if one ever lands in
+// public/. Returns 404 before express.static gets a chance.
+app.use((req, res, next) => {
+  if (/\.(bak|pre-[\w-]+)(\.\w+)?$/i.test(req.path) || /\.pre-/.test(req.path)) {
+    return res.status(404).send('Not found');
+  }
+  next();
+});
+
 app.use(express.static(path.join(__dirname, 'public')));
 
+// Clean-URL routes for the static pages in public/ — lets nav links drop .html.
+for (const name of ['care', 'history', 'sourcing', 'trade', 'vocabulary']) {
+  app.get('/' + name, (req, res) => res.sendFile(path.join(__dirname, 'public', name + '.html')));
+}
+
 app.get('/api/products', (req, res) => {
   const { q, aesthetic, vendor, page = 1, limit = 24, sort = 'newest'} = req.query;
   let list = PRODUCTS_NICHE;

← 06046ea fix /api/facets total: count the niche-filtered list users s · back to Hospitalitywallpaper · redact vendor on customer-facing rail card + add noreferrer 5be8576 →