[object Object]

← back to Metallicwallpaper

fix: remove leaked bak file from public/, tighten 404 guard + gitignore for bak-* pattern

378c8bf5ffcffdd24e3c06eb4bd652840e97e5e3 · 2026-05-30 21:29:09 -0700 · Steve Abrams

- rm public/index.html.bak-20260526152130 (was being served as 200 by express.static)
- add *.bak-* to .gitignore (existing *.bak.* missed hyphen-delimited timestamps)
- fix 404-guard regex to match .bak-TIMESTAMP paths (was only matching .bak. with a dot)
- run npm install (node_modules was absent, causing MODULE_NOT_FOUND on boot)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Files touched

Diff

commit 378c8bf5ffcffdd24e3c06eb4bd652840e97e5e3
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sat May 30 21:29:09 2026 -0700

    fix: remove leaked bak file from public/, tighten 404 guard + gitignore for bak-* pattern
    
    - rm public/index.html.bak-20260526152130 (was being served as 200 by express.static)
    - add *.bak-* to .gitignore (existing *.bak.* missed hyphen-delimited timestamps)
    - fix 404-guard regex to match .bak-TIMESTAMP paths (was only matching .bak. with a dot)
    - run npm install (node_modules was absent, causing MODULE_NOT_FOUND on boot)
    
    Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .gitignore        |  1 +
 package-lock.json | 13 +++++++++++++
 server.js         |  2 +-
 3 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 1140724..3a7a026 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,4 +11,5 @@ build/
 .next/
 *.bak
 *.bak.*
+*.bak-*
 *.pre-*
diff --git a/package-lock.json b/package-lock.json
index de7e116..1518e43 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -8,6 +8,7 @@
       "name": "metallicwallpaper",
       "version": "0.1.0",
       "dependencies": {
+        "dotenv": "^17.4.2",
         "express": "^4.21.0",
         "helmet": "^8.1.0"
       }
@@ -172,6 +173,18 @@
         "npm": "1.2.8000 || >= 1.4.16"
       }
     },
+    "node_modules/dotenv": {
+      "version": "17.4.2",
+      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-17.4.2.tgz",
+      "integrity": "sha512-nI4U3TottKAcAD9LLud4Cb7b2QztQMUEfHbvhTH09bqXTxnSie8WnjPALV/WMCrJZ6UV/qHJ6L03OqO3LcdYZw==",
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://dotenvx.com"
+      }
+    },
     "node_modules/dunder-proto": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
diff --git a/server.js b/server.js
index c3c3e57..6ce403f 100644
--- a/server.js
+++ b/server.js
@@ -152,7 +152,7 @@ require('./_universal-auth')(app, { siteName: "metallicwallpaper" });
 // Belt-and-suspenders 404-guard — never serve backup/pre-* artifacts even if
 // they accidentally land in public/ at deploy time.
 app.use((req, res, next) => {
-  if (/\.(bak|pre-[^/]+)(\.[^/]+)?$|\.bak\.|\.pre-/i.test(req.path)) return res.status(404).end();
+  if (/\.(bak|pre-[^/]+)(\.[^/.-][^/]*)?$|\.bak[\.-]|\.pre-/i.test(req.path)) return res.status(404).end();
   next();
 });
 app.use(express.static(path.join(__dirname, 'public'), { extensions: ['html'] }));

← 2b88e77 feat(fleet): theme1/theme2 query-param-gated toggle on catal  ·  back to Metallicwallpaper  ·  facets: honor q/aesthetic/vendor filters in counts (was unfi 1785419 →