diff options
| author | Peter Stone <thepeterstone@gmail.com> | 2026-08-22 01:08:35 +0000 |
|---|---|---|
| committer | Peter Stone <thepeterstone@gmail.com> | 2026-08-22 01:08:35 +0000 |
| commit | 3b8af4faeca81cb598ad3d366d64d8148534d150 (patch) | |
| tree | a0b6a0453214ba966ba9071f95bb1f27828c0628 /app/src | |
| parent | 7f324168464934d711953dc748fbc7c65eb88f4b (diff) | |
Cleartext exception for 2 feeds with no working HTTPS
webpolicy.org and bit-player.org are genuinely alive but have no
working HTTPS at all (confirmed live, not a config mistake -- see
AppDatabase's v7/v8 migration comments for the investigation).
Everything else stays cleartext-blocked, same as the platform default
with no config at all. Isolated to just this file plus the one
networkSecurityConfig line, so both domains (or this whole exception)
can be removed cleanly if these feeds are ever dropped.
Diffstat (limited to 'app/src')
| -rw-r--r-- | app/src/main/AndroidManifest.xml | 1 | ||||
| -rw-r--r-- | app/src/main/res/xml/network_security_config.xml | 15 |
2 files changed, 16 insertions, 0 deletions
diff --git a/app/src/main/AndroidManifest.xml b/app/src/main/AndroidManifest.xml index a1053e3..325a2cf 100644 --- a/app/src/main/AndroidManifest.xml +++ b/app/src/main/AndroidManifest.xml @@ -16,6 +16,7 @@ android:icon="@mipmap/ic_launcher" android:roundIcon="@mipmap/ic_launcher_round" android:theme="@style/Theme.FeedReader" + android:networkSecurityConfig="@xml/network_security_config" android:allowBackup="false"> <activity diff --git a/app/src/main/res/xml/network_security_config.xml b/app/src/main/res/xml/network_security_config.xml new file mode 100644 index 0000000..c569ba1 --- /dev/null +++ b/app/src/main/res/xml/network_security_config.xml @@ -0,0 +1,15 @@ +<?xml version="1.0" encoding="utf-8"?> +<!-- + Two feeds (webpolicy.org, bit-player.org) are genuinely alive but have no working + HTTPS at all (confirmed live, not a config mistake, see AppDatabase's v7/v8 migration + comments for the investigation). Everything else stays cleartext-blocked, same as the + platform default with no config at all. Deliberately isolated to just this file plus + the one networkSecurityConfig line in AndroidManifest.xml, so both domains, or this + whole exception, can be removed cleanly if these feeds are ever dropped instead. +--> +<network-security-config> + <domain-config cleartextTrafficPermitted="true"> + <domain includeSubdomains="false">webpolicy.org</domain> + <domain includeSubdomains="false">bit-player.org</domain> + </domain-config> +</network-security-config> |