allow manifest.json in theme root (#6986)

closes #6769

core/server/middleware/static-theme.js

@@ -10,6 +10,12 @@ function isBlackListedFileType(file) {
     return _.includes(blackListedFileTypes, ext);
 }
 
+function isWhiteListedFile(file) {
+    var whiteListedFiles = ['manifest.json'],
+        base = path.basename(file);
+    return _.includes(whiteListedFiles, base);
+}
+
 function forwardToExpressStatic(req, res, next) {
     if (!req.app.get('activeTheme')) {
         next();
@@ -23,7 +29,7 @@ function forwardToExpressStatic(req, res, next) {
 
 function staticTheme() {
     return function blackListStatic(req, res, next) {
-        if (isBlackListedFileType(req.path)) {
+        if (!isWhiteListedFile(req.path) && isBlackListedFileType(req.path)) {
             return next();
         }
         return forwardToExpressStatic(req, res, next);

core/test/unit/middleware/static-theme_spec.js

@@ -81,4 +81,25 @@ describe('staticTheme', function () {
             done();
         });
     });
+
+    it('should not call next if file is on whitelist', function (done) {
+        var req = {
+                path: 'manifest.json',
+                app: {
+                    get: function () { return 'casper'; }
+                }
+            },
+            activeThemeStub,
+            sandbox = sinon.sandbox.create();
+
+        activeThemeStub = sandbox.spy(req.app, 'get');
+
+        staticTheme(null)(req, null, function (reqArg, res, next2) {
+            /*jshint unused:false */
+            sandbox.restore();
+            next.called.should.be.false();
+            activeThemeStub.called.should.be.true();
+            done();
+        });
+    });
 });