From 17250333d55e2309125352678c4c052f8e6b9e12 Mon Sep 17 00:00:00 2001
From: naurakrbna <naurakaribiana@gmail.com>
Date: Mon, 16 Mar 2026 14:02:54 +0700
Subject: [PATCH] MW-SEC-015: disable backup in AndroidManifest

---
 cmp-android/src/main/AndroidManifest.xml       |  4 +++-
 .../src/main/res/xml/data_extraction_rules.xml | 18 ++++++++++++++++++
 2 files changed, 21 insertions(+), 1 deletion(-)
 create mode 100644 cmp-android/src/main/res/xml/data_extraction_rules.xml

diff --git a/cmp-android/src/main/AndroidManifest.xml b/cmp-android/src/main/AndroidManifest.xml
index f773d561e..245a01867 100644
--- a/cmp-android/src/main/AndroidManifest.xml
+++ b/cmp-android/src/main/AndroidManifest.xml
@@ -34,7 +34,9 @@
 
     <application
         android:name=".MifosPayApp"
-        android:allowBackup="true"
+        android:allowBackup="false"
+        android:dataExtractionRules="@xml/data_extraction_rules"
+        android:fullBackupContent="false"
         android:icon="@mipmap/ic_launcher"
         android:label="@string/app_name"
         android:roundIcon="@mipmap/ic_launcher_round"
diff --git a/cmp-android/src/main/res/xml/data_extraction_rules.xml b/cmp-android/src/main/res/xml/data_extraction_rules.xml
new file mode 100644
index 000000000..58f4cbef3
--- /dev/null
+++ b/cmp-android/src/main/res/xml/data_extraction_rules.xml
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+    Copyright 2024 Mifos Initiative
+
+    This Source Code Form is subject to the terms of the Mozilla Public License, v. 2.0.
+    If a copy of the MPL was not distributed with this file,
+    You can obtain one at https://mozilla.org/MPL/2.0/.
+
+    See https://github.com/openMF/mobile-wallet/blob/master/LICENSE.md
+-->
+<data-extraction-rules>
+    <cloud-backup>
+        <exclude domain="root" />
+    </cloud-backup>
+    <device-transfer>
+        <exclude domain="root" />
+    </device-transfer>
+</data-extraction-rules>