diff --git a/app/src/main/java/eu/faircode/email/ApplicationEx.java b/app/src/main/java/eu/faircode/email/ApplicationEx.java
index d24683f5ed..bbc67f4b2c 100644
--- a/app/src/main/java/eu/faircode/email/ApplicationEx.java
+++ b/app/src/main/java/eu/faircode/email/ApplicationEx.java
@@ -645,6 +645,10 @@ public class ApplicationEx extends Application
}
} else if (version < 1947)
editor.putBoolean("accept_unsupported", true);
+ else if (version < 1951) {
+ if (prefs.contains("open_unsafe"))
+ editor.putBoolean("open_safe", !prefs.getBoolean("open_unsafe", true));
+ }
if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O && !BuildConfig.DEBUG)
editor.remove("background_service");
diff --git a/app/src/main/java/eu/faircode/email/ConnectionHelper.java b/app/src/main/java/eu/faircode/email/ConnectionHelper.java
index fb827f8f70..4d87bd8713 100644
--- a/app/src/main/java/eu/faircode/email/ConnectionHelper.java
+++ b/app/src/main/java/eu/faircode/email/ConnectionHelper.java
@@ -673,7 +673,7 @@ public class ConnectionHelper {
static HttpURLConnection openConnectionUnsafe(Context context, URL url, int ctimeout, int rtimeout) throws IOException {
SharedPreferences prefs = PreferenceManager.getDefaultSharedPreferences(context);
- boolean open_unsafe = prefs.getBoolean("open_unsafe", true);
+ boolean open_safe = prefs.getBoolean("open_safe", false);
int redirects = 0;
while (true) {
@@ -685,7 +685,7 @@ public class ConnectionHelper {
urlConnection.setInstanceFollowRedirects(true);
if (urlConnection instanceof HttpsURLConnection) {
- if (open_unsafe)
+ if (!open_safe)
((HttpsURLConnection) urlConnection).setHostnameVerifier(new HostnameVerifier() {
@Override
public boolean verify(String hostname, SSLSession session) {
@@ -693,7 +693,7 @@ public class ConnectionHelper {
}
});
} else {
- if (!open_unsafe)
+ if (open_safe)
throw new IOException("https required url=" + url);
}
@@ -703,7 +703,7 @@ public class ConnectionHelper {
try {
int status = urlConnection.getResponseCode();
- if (open_unsafe &&
+ if (!open_safe &&
(status == HttpURLConnection.HTTP_MOVED_PERM ||
status == HttpURLConnection.HTTP_MOVED_TEMP ||
status == HttpURLConnection.HTTP_SEE_OTHER ||
diff --git a/app/src/main/java/eu/faircode/email/FragmentOptionsConnection.java b/app/src/main/java/eu/faircode/email/FragmentOptionsConnection.java
index 5f033e2544..f3ef62d30f 100644
--- a/app/src/main/java/eu/faircode/email/FragmentOptionsConnection.java
+++ b/app/src/main/java/eu/faircode/email/FragmentOptionsConnection.java
@@ -79,7 +79,7 @@ public class FragmentOptionsConnection extends FragmentBase implements SharedPre
private SwitchCompat swSslHarden;
private SwitchCompat swSslHardenStrict;
private SwitchCompat swCertStrict;
- private SwitchCompat swOpenUnsafe;
+ private SwitchCompat swOpenSafe;
private Button btnManage;
private TextView tvNetworkMetered;
private TextView tvNetworkRoaming;
@@ -94,7 +94,7 @@ public class FragmentOptionsConnection extends FragmentBase implements SharedPre
"download_headers", "download_eml", "download_plain",
"require_validated", "vpn_only",
"timeout", "prefer_ip4", "bind_socket", "standalone_vpn", "tcp_keep_alive",
- "ssl_harden", "ssl_harden_strict", "cert_strict", "open_unsafe"
+ "ssl_harden", "ssl_harden_strict", "cert_strict", "open_safe"
};
@Override
@@ -126,7 +126,7 @@ public class FragmentOptionsConnection extends FragmentBase implements SharedPre
swSslHarden = view.findViewById(R.id.swSslHarden);
swSslHardenStrict = view.findViewById(R.id.swSslHardenStrict);
swCertStrict = view.findViewById(R.id.swCertStrict);
- swOpenUnsafe = view.findViewById(R.id.swOpenUnsafe);
+ swOpenSafe = view.findViewById(R.id.swOpenSafe);
btnManage = view.findViewById(R.id.btnManage);
tvNetworkMetered = view.findViewById(R.id.tvNetworkMetered);
@@ -309,10 +309,10 @@ public class FragmentOptionsConnection extends FragmentBase implements SharedPre
}
});
- swOpenUnsafe.setOnCheckedChangeListener(new CompoundButton.OnCheckedChangeListener() {
+ swOpenSafe.setOnCheckedChangeListener(new CompoundButton.OnCheckedChangeListener() {
@Override
public void onCheckedChanged(CompoundButton compoundButton, boolean checked) {
- prefs.edit().putBoolean("open_unsafe", checked).apply();
+ prefs.edit().putBoolean("open_safe", checked).apply();
}
});
@@ -450,7 +450,7 @@ public class FragmentOptionsConnection extends FragmentBase implements SharedPre
swSslHardenStrict.setChecked(prefs.getBoolean("ssl_harden_strict", false));
swSslHardenStrict.setEnabled(swSslHarden.isChecked());
swCertStrict.setChecked(prefs.getBoolean("cert_strict", !BuildConfig.PLAY_STORE_RELEASE));
- swOpenUnsafe.setChecked(prefs.getBoolean("open_unsafe", true));
+ swOpenSafe.setChecked(prefs.getBoolean("open_safe", false));
}
private static Intent getIntentConnectivity() {
diff --git a/app/src/main/res/layout/fragment_options_connection.xml b/app/src/main/res/layout/fragment_options_connection.xml
index 0cd8f9e45f..7f959e23a9 100644
--- a/app/src/main/res/layout/fragment_options_connection.xml
+++ b/app/src/main/res/layout/fragment_options_connection.xml
@@ -484,28 +484,27 @@
app:layout_constraintTop_toBottomOf="@id/swCertStrict" />
+ app:layout_constraintTop_toBottomOf="@id/swOpenSafe" />
+ app:layout_constraintTop_toBottomOf="@id/tvOpenSafeHint" />
Harden SSL connections
Require TLS 1.3
Strict certificate checking
- Open insecure connections
+ Open secure connections only
Manage connectivity
General
@@ -866,7 +866,7 @@
The read/write timeout will be set to the double of the connection timeout. Higher values will result in more battery use.
Disabling this will relax checking of server certificates
Enabling this will disable weak SSL protocols and ciphers, which can lead to connection problems
- Disabling this will require secure connections to download images
+ Enabling this will require secure connections to download images, etc
Messages headers will always be fetched when roaming. You can use the device\'s roaming setting to disable internet while roaming.
Fetch more messages when scrolling down