fix: block .bak-* timestamped backup files from being served and remove leaked public/index.html.bak-20260526152130

f7e022773f2ae528fd055825164b50b28de9dc0c · 2026-05-30 21:28:24 -0700 · Steve Abrams

- Deleted public/index.html.bak-20260526152130 which was reachable at /index.html.bak-20260526152130 (returned 200)
- Fixed backup-file guard regex in server.js: old pattern \.bak$ missed *.bak-TIMESTAMP filenames; new pattern \.bak[-.]| also catches dash-suffixed variants
- Added *.bak-* to .gitignore so timestamped editor snapshots are not committed in future

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Files touched

M .gitignore
M server.js

Diff

commit f7e022773f2ae528fd055825164b50b28de9dc0c
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sat May 30 21:28:24 2026 -0700

    fix: block .bak-* timestamped backup files from being served and remove leaked public/index.html.bak-20260526152130
    
    - Deleted public/index.html.bak-20260526152130 which was reachable at /index.html.bak-20260526152130 (returned 200)
    - Fixed backup-file guard regex in server.js: old pattern \.bak$ missed *.bak-TIMESTAMP filenames; new pattern \.bak[-.]| also catches dash-suffixed variants
    - Added *.bak-* to .gitignore so timestamped editor snapshots are not committed in future
    
    Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .gitignore | 1 +
 server.js  | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 0b76591..3b1c9b3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,5 +11,6 @@ build/
 .next/
 *.bak
 *.bak.*
+*.bak-*
 *.pre-*
 *.orig
diff --git a/server.js b/server.js
index 6a74b51..b02d07b 100644
--- a/server.js
+++ b/server.js
@@ -147,7 +147,7 @@ require("./_universal-contact")(app, cfg.contact);
 require("./_universal-auth")(app, cfg.auth);
 // Never serve editor snapshots from static root.
 app.use((req, res, next) => {
-  if (/\.(bak|pre-[^/]*|orig|swp)(\.|$)|\.bak$|\.pre-/i.test(req.path)) {
+  if (/\.(bak|pre-[^/]*|orig|swp)([.\-]|$)|\.bak[-.]|\.pre-/i.test(req.path)) {
     return res.status(404).send('Not found');
   }
   next();

← a44e596 feat(fleet): theme1/theme2 query-param-gated toggle on catal · back to Recycledwallpaper · Remove Big Red widget — never UX-worked, collided with Help b5c67a4 →