Merge "Add API definition for WebSettings.allowMixedContent"
diff --git a/api/current.txt b/api/current.txt
index 71dc9f6..167ae80 100644
--- a/api/current.txt
+++ b/api/current.txt
@@ -32923,6 +32923,7 @@
method public boolean getMediaPlaybackRequiresUserGesture();
method public synchronized int getMinimumFontSize();
method public synchronized int getMinimumLogicalFontSize();
+ method public abstract int getMixedContentMode();
method public deprecated synchronized android.webkit.WebSettings.PluginState getPluginState();
method public synchronized java.lang.String getSansSerifFontFamily();
method public boolean getSaveFormData();
@@ -32967,6 +32968,7 @@
method public void setMediaPlaybackRequiresUserGesture(boolean);
method public synchronized void setMinimumFontSize(int);
method public synchronized void setMinimumLogicalFontSize(int);
+ method public abstract void setMixedContentMode(int);
method public void setNeedInitialFocus(boolean);
method public deprecated synchronized void setPluginState(android.webkit.WebSettings.PluginState);
method public deprecated synchronized void setRenderPriority(android.webkit.WebSettings.RenderPriority);
@@ -32988,6 +32990,9 @@
field public static final int LOAD_DEFAULT = -1; // 0xffffffff
field public static final deprecated int LOAD_NORMAL = 0; // 0x0
field public static final int LOAD_NO_CACHE = 2; // 0x2
+ field public static final int MIXED_CONTENT_ALWAYS_ALLOW = 0; // 0x0
+ field public static final int MIXED_CONTENT_COMPATIBILITY_MODE = 2; // 0x2
+ field public static final int MIXED_CONTENT_NEVER_ALLOW = 1; // 0x1
}
public static final class WebSettings.LayoutAlgorithm extends java.lang.Enum {
diff --git a/core/java/android/webkit/WebSettings.java b/core/java/android/webkit/WebSettings.java
index 98ef66e..7c32c5b 100644
--- a/core/java/android/webkit/WebSettings.java
+++ b/core/java/android/webkit/WebSettings.java
@@ -171,6 +171,38 @@
}
/**
+ * Used with {@link #setMixedContentMode}
+ *
+ * In this mode, the WebView will allow a secure origin to load content from any other origin,
+ * even if that origin is insecure. This is the least secure mode of operation for the WebView,
+ * and where possible apps should not set this mode.
+ */
+ public static final int MIXED_CONTENT_ALWAYS_ALLOW = 0;
+
+ /**
+ * Used with {@link #setMixedContentMode}
+ *
+ * In this mode, the WebView will not allow a secure origin to load content from an insecure
+ * origin. This is the preferred and most secure mode of operation for the WebView and apps are
+ * strongly advised to use this mode.
+ */
+ public static final int MIXED_CONTENT_NEVER_ALLOW = 1;
+
+ /**
+ * Used with {@link #setMixedContentMode}
+ *
+ * In this mode, the WebView will attempt to be compatible with the approach of a modern web
+ * browser with regard to mixed content. Some insecure content may be allowed to be loaded by
+ * a secure origin and other types of content will be blocked. The types of content are allowed
+ * or blocked may change release to release and are not explicitly defined.
+ *
+ * This mode is intended to be used by apps that are not in control of the content that they
+ * render but desire to operate in a reasonably secure environment. For highest security, apps
+ * are recommended to use {@link #MIXED_CONTENT_NEVER_ALLOW}.
+ */
+ public static final int MIXED_CONTENT_COMPATIBILITY_MODE = 2;
+
+ /**
* Hidden constructor to prevent clients from creating a new settings
* instance or deriving the class.
*
@@ -1403,4 +1435,29 @@
public int getCacheMode() {
throw new MustOverrideException();
}
+
+ /**
+ * Configures the WebView's behavior when a secure origin attempts to load a resource from an
+ * insecure origin.
+ *
+ * By default, apps that target {@link android.os.Build.VERSION_CODES#KITKAT} or below default
+ * to {@link #MIXED_CONTENT_ALWAYS_ALLOW}. Apps targeting
+ * {@link android.os.Build.VERSION_CODES#L} default to {@link #MIXED_CONTENT_NEVER_ALLOW}.
+ *
+ * The preferred and most secure mode of operation for the WebView is
+ * {@link #MIXED_CONTENT_NEVER_ALLOW} and use of {@link #MIXED_CONTENT_ALWAYS_ALLOW} is
+ * strongly discouraged.
+ *
+ * @param mode The mixed content mode to use. One of {@link #MIXED_CONTENT_NEVER_ALLOW},
+ * {@link #MIXED_CONTENT_NEVER_ALLOW} or {@link #MIXED_CONTENT_COMPATIBILITY_MODE}.
+ */
+ public abstract void setMixedContentMode(int mode);
+
+ /**
+ * Gets the current behavior of the WebView with regard to loading insecure content from a
+ * secure origin.
+ * @return The current setting, one of {@link #MIXED_CONTENT_NEVER_ALLOW},
+ * {@link #MIXED_CONTENT_NEVER_ALLOW} or {@link #MIXED_CONTENT_COMPATIBILITY_MODE}.
+ */
+ public abstract int getMixedContentMode();
}