fix SSL host verification not being disabled by "trust all hosts"

2 files changed, 16 insertions, 0 deletions

diff --git a/src/org/fox/ttrss/ApiRequest.java b/src/org/fox/ttrss/ApiRequest.java
index 53661885..c3cae1a5 100644
--- a/src/org/fox/ttrss/ApiRequest.java
+++ b/src/org/fox/ttrss/ApiRequest.java
@@ -12,8 +12,10 @@ import java.nio.CharBuffer;
 import java.security.cert.CertificateException;

 import java.util.HashMap;

 

+import javax.net.ssl.HostnameVerifier;

 import javax.net.ssl.HttpsURLConnection;

 import javax.net.ssl.SSLContext;

+import javax.net.ssl.SSLSession;

 import javax.net.ssl.TrustManager;

 import javax.net.ssl.X509TrustManager;

 

@@ -291,6 +293,12 @@ public class ApiRequest extends AsyncTask<HashMap<String,String>, Integer, JsonE
 	        sc.init(null, trustAllCerts, new java.security.SecureRandom());

 

 	        HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());

+	        HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier() {				

+				@Override

+				public boolean verify(String hostname, SSLSession session) {

+					return true;

+				}

+			});

 

 	    } catch (Exception e) {

 	            e.printStackTrace();

diff --git a/src/org/fox/ttrss/FeedsFragment.java b/src/org/fox/ttrss/FeedsFragment.java
index 8be4d92e..7462876c 100644
--- a/src/org/fox/ttrss/FeedsFragment.java
+++ b/src/org/fox/ttrss/FeedsFragment.java
@@ -15,8 +15,10 @@ import java.util.Comparator;
 import java.util.HashMap;

 import java.util.List;

 

+import javax.net.ssl.HostnameVerifier;

 import javax.net.ssl.HttpsURLConnection;

 import javax.net.ssl.SSLContext;

+import javax.net.ssl.SSLSession;

 import javax.net.ssl.TrustManager;

 import javax.net.ssl.X509TrustManager;

 

@@ -606,6 +608,12 @@ public class FeedsFragment extends Fragment implements OnItemClickListener, OnSh
 		        sc.init(null, trustAllCerts, new java.security.SecureRandom());

 

 		        HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());

+		        HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier() {				

+					@Override

+					public boolean verify(String hostname, SSLSession session) {

+						return true;

+					}

+				});

 

 		    } catch (Exception e) {

 		            e.printStackTrace();