Aman-Mittal opened a new issue, #215: URL: https://github.com/apache/fineract-backoffice-ui/issues/215
Part of the GA security hardening work. ## Summary The server picker on the login form hard-codes external demo endpoints as selectable options, alongside the deployment's own. They ship in every production build. ## Business value **A credential-entry form should not invite anyone to post credentials to someone else's server.** A teller who picks the wrong entry from a dropdown types their real username and password into a third-party host. There is no warning, and the option sits next to the legitimate one in the same list. Even setting aside malice, this is a routine way to leak working credentials — a mis-click during training, or a stale selection remembered from a previous session. It also makes the unvalidated endpoint override materially worse: the dropdown is the discoverable path to it. ## Scope Offer only what the deployment sanctions: its own configured endpoint, the same-origin proxy, and any origins named in `config.json`. A custom URL remains possible for operators, but is checked against the same allow-list as everything else rather than accepted on trust. ## Acceptance criteria - [ ] No external hostnames remain hard-coded in the component. - [ ] The picker is built from deployment configuration. - [ ] A custom URL is validated before any credential is sent. - [ ] `npm run ga:check` reports this gate as passing. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
