fix: remove public backup file leak + fix bak-* middleware/gitignore gaps

edce735d9976f80c1c44c3bab411a929dd9046f3 · 2026-05-30 21:26:55 -0700 · Steve Abrams

- Delete public/index.html.bak-20260526152130 (was served as 200, leaking source)
- Fix bak-block middleware regex to match .bak-TIMESTAMP pattern (hyphen variant was not caught)
- Add *.bak-* to .gitignore so future timestamped backups are excluded

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Files touched

M .gitignore
M server.js

Diff

commit edce735d9976f80c1c44c3bab411a929dd9046f3
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sat May 30 21:26:55 2026 -0700

    fix: remove public backup file leak + fix bak-* middleware/gitignore gaps
    
    - Delete public/index.html.bak-20260526152130 (was served as 200, leaking source)
    - Fix bak-block middleware regex to match .bak-TIMESTAMP pattern (hyphen variant was not caught)
    - Add *.bak-* to .gitignore so future timestamped backups are excluded
    
    Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .gitignore | 1 +
 server.js  | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 1140724..3a7a026 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,4 +11,5 @@ build/
 .next/
 *.bak
 *.bak.*
+*.bak-*
 *.pre-*
diff --git a/server.js b/server.js
index 493c5a5..0d96ab2 100644
--- a/server.js
+++ b/server.js
@@ -80,7 +80,7 @@ require("./_universal-auth")(app, cfg.auth);
 app.locals.siteConfig = cfg;
 // Block access to editor snapshot files that linger in public/ (source disclosure).
 app.use((req, res, next) => {
-  if (/\.(bak|pre-[^/]*)(\.[^/]*)?$/i.test(req.path) || /\.bak\./i.test(req.path) || /\.pre-/i.test(req.path)) {
+  if (/\.(bak[-.]?[^/]*|pre-[^/]*)(\.[^/]*)?$/i.test(req.path) || /\.bak[-.]|\.pre-/i.test(req.path)) {
     return res.status(404).send('Not found');
   }
   next();

← e0598fb feat(fleet): theme1/theme2 query-param-gated toggle on catal · back to Screenprintedwallpaper · seo: 301 redirect legacy .html editorial pages to clean URLs 1baf648 →