diff --git a/app/src/main/java/eu/faircode/email/ConnectionHelper.java b/app/src/main/java/eu/faircode/email/ConnectionHelper.java index 262cab7f2f..8e6b65e79a 100644 --- a/app/src/main/java/eu/faircode/email/ConnectionHelper.java +++ b/app/src/main/java/eu/faircode/email/ConnectionHelper.java @@ -723,6 +723,7 @@ public class ConnectionHelper { // https://support.google.com/faqs/answer/7188426 SharedPreferences prefs = PreferenceManager.getDefaultSharedPreferences(context); boolean open_safe = prefs.getBoolean("open_safe", false); + boolean http_redirect = prefs.getBoolean("http_redirect", true); int redirects = 0; while (true) { @@ -752,7 +753,7 @@ public class ConnectionHelper { try { int status = urlConnection.getResponseCode(); - if (!open_safe && + if (http_redirect && (status == HttpURLConnection.HTTP_MOVED_PERM || status == HttpURLConnection.HTTP_MOVED_TEMP || status == HttpURLConnection.HTTP_SEE_OTHER || diff --git a/app/src/main/java/eu/faircode/email/FragmentOptionsConnection.java b/app/src/main/java/eu/faircode/email/FragmentOptionsConnection.java index 5d622cd0f2..0568de4497 100644 --- a/app/src/main/java/eu/faircode/email/FragmentOptionsConnection.java +++ b/app/src/main/java/eu/faircode/email/FragmentOptionsConnection.java @@ -99,6 +99,7 @@ public class FragmentOptionsConnection extends FragmentBase implements SharedPre private SwitchCompat swSslHardenStrict; private SwitchCompat swCertStrict; private SwitchCompat swOpenSafe; + private SwitchCompat swHttpRedirect; private SwitchCompat swBouncyCastle; private SwitchCompat swFipsMode; private ImageButton ibBouncyCastle; @@ -120,7 +121,8 @@ public class FragmentOptionsConnection extends FragmentBase implements SharedPre "download_headers", "download_eml", "download_plain", "require_validated", "require_validated_captive", "vpn_only", "timeout", "prefer_ip4", "bind_socket", "standalone_vpn", "tcp_keep_alive", - "ssl_harden", "ssl_harden_strict", "cert_strict", "open_safe", "bouncy_castle", "bc_fips" + "ssl_harden", "ssl_harden_strict", "cert_strict", "open_safe", "http_redirect", + "bouncy_castle", "bc_fips" }; @Override @@ -154,6 +156,7 @@ public class FragmentOptionsConnection extends FragmentBase implements SharedPre swSslHardenStrict = view.findViewById(R.id.swSslHardenStrict); swCertStrict = view.findViewById(R.id.swCertStrict); swOpenSafe = view.findViewById(R.id.swOpenSafe); + swHttpRedirect = view.findViewById(R.id.swHttpRedirect); swBouncyCastle = view.findViewById(R.id.swBouncyCastle); swFipsMode = view.findViewById(R.id.swFipsMode); ibBouncyCastle = view.findViewById(R.id.ibBouncyCastle); @@ -361,6 +364,13 @@ public class FragmentOptionsConnection extends FragmentBase implements SharedPre } }); + swHttpRedirect.setOnCheckedChangeListener(new CompoundButton.OnCheckedChangeListener() { + @Override + public void onCheckedChanged(CompoundButton compoundButton, boolean checked) { + prefs.edit().putBoolean("http_redirect", checked).apply(); + } + }); + swBouncyCastle.setOnCheckedChangeListener(new CompoundButton.OnCheckedChangeListener() { @Override public void onCheckedChanged(CompoundButton compoundButton, boolean checked) { @@ -660,6 +670,7 @@ public class FragmentOptionsConnection extends FragmentBase implements SharedPre swSslHardenStrict.setEnabled(swSslHarden.isChecked()); swCertStrict.setChecked(prefs.getBoolean("cert_strict", true)); swOpenSafe.setChecked(prefs.getBoolean("open_safe", false)); + swHttpRedirect.setChecked(prefs.getBoolean("http_redirect", true)); swBouncyCastle.setChecked(prefs.getBoolean("bouncy_castle", false)); swFipsMode.setChecked(prefs.getBoolean("bc_fips", false)); swFipsMode.setEnabled(swBouncyCastle.isChecked()); diff --git a/app/src/main/res/layout/fragment_options_connection.xml b/app/src/main/res/layout/fragment_options_connection.xml index 32c4e157fe..6755b62ccc 100644 --- a/app/src/main/res/layout/fragment_options_connection.xml +++ b/app/src/main/res/layout/fragment_options_connection.xml @@ -519,6 +519,17 @@ app:layout_constraintStart_toStartOf="parent" app:layout_constraintTop_toBottomOf="@id/swOpenSafe" /> + + Require TLS 1.3 Strict certificate checking Open secure connections only + Allow redirecting HTTP connections Use Bouncy Castle\'s secure socket provider (JSSE) FIPS mode Manage connectivity