fix: remove public bak leak, patch 404-guard regex for .bak-* pattern, add .bak- to .gitignore

c87ade681049d20b5453bc49e5066a6c0048d744 · 2026-05-30 21:26:37 -0700 · Steve Abrams

- Deleted public/index.html.bak-20260526152130 (was served as HTTP 200)
- 404-guard regex /\.(bak)(\.|$)/ did not match .bak-TIMESTAMP filenames; added [-] to alternation
- .gitignore missing *.bak-* glob — added alongside existing *.bak and *.bak.* entries

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Files touched

M .gitignore
M server.js

Diff

commit c87ade681049d20b5453bc49e5066a6c0048d744
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sat May 30 21:26:37 2026 -0700

    fix: remove public bak leak, patch 404-guard regex for .bak-* pattern, add *.bak-* to .gitignore
    
    - Deleted public/index.html.bak-20260526152130 (was served as HTTP 200)
    - 404-guard regex /\.(bak)(\.|$)/ did not match .bak-TIMESTAMP filenames; added [-] to alternation
    - .gitignore missing *.bak-* glob — added alongside existing *.bak and *.bak.* entries
    
    Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .gitignore | 1 +
 server.js  | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 1140724..3a7a026 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,4 +11,5 @@ build/
 .next/
 *.bak
 *.bak.*
+*.bak-*
 *.pre-*
diff --git a/server.js b/server.js
index ed3e6d3..8d7b780 100644
--- a/server.js
+++ b/server.js
@@ -148,7 +148,7 @@ require("./_universal-contact")(app, cfg.contact);
 require("./_universal-auth")(app, cfg.auth);
 // 404-guard: never serve editor snapshot files (*.bak, *.bak.*, *.pre-*) from static root.
 app.use((req, res, next) => {
-  if (/\.(bak)(\.|$)|\.pre-/i.test(req.path)) return res.status(404).send('Not found');
+  if (/\.(bak)(\.|[-]|$)|\.pre-/i.test(req.path)) return res.status(404).send('Not found');
   next();
 });

← 732647c feat(fleet): theme1/theme2 query-param-gated toggle on catal · back to Saloonwallpaper · facets: drill-down counts via shared filterProducts() — each 19b87d4 →