admin/CMS

T

Build and Deploy to Kubernetes / build-and-deploy (push) Successful in 9m28s

Details

security: remove callback URL from user input — read from FrontOfficeBaseUrl config

- PackageService: build callback URL from FrontOfficeBaseUrl config instead of request.CallbackUrl
- TransactionsService: same fix — callback URL from config
- Prevents potential open redirect vulnerability (user could send arbitrary URL)

All callback URLs now come from appsettings FrontOfficeBaseUrl or CmsBaseUrl.

2026-02-27 22:20:04 +03:30

.gitea/workflows

feat: externalize appsettings to K8s Secret — config persists independently of image rebuilds

2026-02-23 21:58:05 +03:30

docs

feat: Implement file management and authorization features

2026-02-10 22:04:54 +03:30

k8s

fix: remove double ×10 Rial conversion in ZarinPalPaymentService

2026-02-24 00:49:16 +03:30

src

security: remove callback URL from user input — read from FrontOfficeBaseUrl config