Completed :latest

Request: Option to remove patchmon version from login screen

Hi,
we are testing Patchmon for a few days now, and we really liked it. But why is the login website showing so much information? Links to the github page and promotion for the project are totally fine. We restricted the access to the site, and allowed only our public ip address.

problem:
Showing the version number at the login website, give possible attackers the version number. They can then use this information to find vulnerabilities even easier. At the most websites you try to hide these kind of information.

request:
Can you please give as an option to turn this off? I know i can hide this with css, but you can still find it then easily. I looked through the code and find the part where you give back the version info. It seems that you not display this in mobile mode. So i think this could be not that hard to inplement. 😅Maybe i will look deeper into patchmon, when i have some time. Then i could provide a pull request... 😊It's been i while since i used javascript and react.

thanks for this great app!

{/* Left side - Info Panel (hidden on mobile) */}
			<div className="hidden lg:flex lg:w-1/2 xl:w-3/5 relative z-10">
				<div className="flex flex-col justify-between text-white p-12 h-full w-full">
					<div className="flex-1 flex flex-col justify-center items-start max-w-xl mx-auto">
						<div className="space-y-6">

4 Comments

9technologygroup·8 months ago

Hey, I've completed this:

Then the login page appears like this :

Will be released shortly.

9technologygroup·8 months ago

Hi team

I agree with the ability to turn off github information on the front login screen - the login screen actually shows the latest release information from github as opposed to what the server version it itself.

Regardless, I will implement a toggle where this can be disabled.

Customisation is key and so thank you for bringing this up to me.

Thanks
iby

cquike·8 months ago

In addition to that, this makes connection to github, as seen with the noscript extension. Under some security policies you might allow the domain where patchmon is deployed to make connections but not others. So when connecting to patchmon.my.domain you know only connections within my.domain are done.

FDrebin·8 months ago

I agree with this whether its a public or private instance, the login window should include the minimal amount of anything. No project links, version(s), etc. Just user/password, login button etc.