fix: remove leaked bak file from public/ and patch 404-guard regex to block bak-TIMESTAMP filenames

02575fa41616b27466c15ca1144602ff70fb19f6 · 2026-05-30 21:26:17 -0700 · Steve Abrams

public/index.html.bak-20260526152130 was being served via express.static because
the 404-guard regex only matched .bak and .bak.\d+ (dot-separated) patterns, not
the bak-TIMESTAMP (hyphen) variant produced by the deploy script. Deleted the file
and updated the guard to /\.bak([.-]|$)/ which catches all variants.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Files touched

M server.js

Diff

commit 02575fa41616b27466c15ca1144602ff70fb19f6
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sat May 30 21:26:17 2026 -0700

    fix: remove leaked bak file from public/ and patch 404-guard regex to block bak-TIMESTAMP filenames
    
    public/index.html.bak-20260526152130 was being served via express.static because
    the 404-guard regex only matched .bak and .bak.\d+ (dot-separated) patterns, not
    the bak-TIMESTAMP (hyphen) variant produced by the deploy script. Deleted the file
    and updated the guard to /\.bak([.-]|$)/ which catches all variants.
    
    Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 server.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server.js b/server.js
index 4c851d8..8b04814 100644
--- a/server.js
+++ b/server.js
@@ -154,7 +154,7 @@ require("./_universal-contact")(app, cfg.contact);
 require("./_universal-auth")(app, cfg.auth);
 // 404-guard: even if a backup file ever leaks into public/, never serve it.
 app.use((req, res, next) => {
-  if (/\.(bak|bak\.\d+)$|\.pre-/i.test(req.path)) return res.status(404).end();
+  if (/\.bak([.-]|$)|\.pre-|\.orig$/i.test(req.path)) return res.status(404).end();
   next();
 });
 app.use(express.static(path.join(__dirname, 'public')));

← 0391344 feat(fleet): theme1/theme2 query-param-gated toggle on catal · back to Silkwallcoverings · 301-redirect legacy .html pages to clean URLs (kill duplicat a11fb5a →