wordpress-mobile / wordpress-mobile/WordPress-Android
Self Signed SSL login works for 6.9.1, does not work for 7.0, 7.x
Nobody has claimed this yet.
- Dominant language
- Kotlin
- Stars
- 3.2k
- Forks
- 1.4k
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 69
Description
I was on autoupdate on google-play-app-store
Downgraded to 6.9.1
tried a few things.
I'm going to not upgrade beyond 6.9.1 for a while.
Expected behavior
- start app
- fill in username, passwd, self-hosted ssl url
- dialog prompts to ask to allow self signed unverifyable ssl certificate, say yes,
- should login, for 6.9.1 site screen shows up, but does not for 7.0 and above
Actual behavior
- does not login after wordpress android app 7.0 vercode:376 upto 7.9.1-rc2
- login succeeds for 6.9.1 vercode:360 (apk retrieved from apkmirror)
Steps to reproduce the behavior
- made fresh self signed CA certificate and server certificate
create a cacert.pem, priv.key, host.crt, host.key as described in
http://www.eclectica.ca/howto/ssl-cert-howto.php - desktop: add certificate to firefox on desktop browser
- desktop: check that wordpress working from desktop browser
- android: add cacert.pem into android settings->general->security->certificates->user
- android: check that wordpress site working from android browser
- install and try each wordpress apk
App logs uploaded for both cases
wp70_log.txt
wp691_log.txt
Repeated a few times to be sure
7.0, vercode:376 was released on Apr-4-2017: API:16-25
6.9.1, vercode:360 was released on Mar-28-2017: API:16-25
I had not noticed this sooner as had not used wordpress app on phone for a while
Tested on [device], Android [version]
LG G3 D855
Android 6.0 lollypop V30b-GLOBAL-COM
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by comparing the attached wp70_log.txt and wp691_log.txt, then reproduce the login flow across the reported app versions on Android with the self-signed certificate setup. Done means a self-signed HTTPS WordPress site can log in successfully on the affected 7.x versions, as it does in 6.9.1.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android
- Domain
- mobile-dev, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100