This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/release24.09 by this push:
new c9c76ed82f Fixed: URLConnector.openUntrustedConnection(...) public
overloads silently performed trusted SSL connections (OFBIZ-13484) (#1570)
c9c76ed82f is described below
commit c9c76ed82f48fd8109d596d35cee65b4afd7e39b
Author: Mridul Pathak <[email protected]>
AuthorDate: Fri Aug 7 10:51:47 2026 +0530
Fixed: URLConnector.openUntrustedConnection(...) public overloads silently
performed trusted SSL connections (OFBIZ-13484) (#1570)
Fixed: URLConnector.openUntrustedConnection(...) public overloads silently
performed trusted SSL connections (OFBIZ-13484)
The three public openUntrustedConnection overloads delegated to the trusted
openConnection(...) path instead of the untrusted one, so trustAnyCert was
always false despite the method name and "allow untrusted certs" comment. Only
the package-private 4-arg overload (the one HttpClient actually calls) set
trustAnyCert=true correctly. This change makes the three public overloads
delegate to openUntrustedConnection(...) instead, mirroring the existing
trusted-path delegation pattern. Not [...]
Backported from trunk (#1569).
---
.../base/src/main/java/org/apache/ofbiz/base/util/URLConnector.java | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git
a/framework/base/src/main/java/org/apache/ofbiz/base/util/URLConnector.java
b/framework/base/src/main/java/org/apache/ofbiz/base/util/URLConnector.java
index 7855c3b8b1..cdf362ecb2 100644
--- a/framework/base/src/main/java/org/apache/ofbiz/base/util/URLConnector.java
+++ b/framework/base/src/main/java/org/apache/ofbiz/base/util/URLConnector.java
@@ -100,15 +100,15 @@ public class URLConnector {
// allow untrusted certs
public static URLConnection openUntrustedConnection(URL url) throws
IOException {
- return openConnection(url, 30000);
+ return openUntrustedConnection(url, 30000);
}
public static URLConnection openUntrustedConnection(URL url, int timeout)
throws IOException {
- return openConnection(url, timeout, null,
SSLUtil.getHostCertNormalCheck());
+ return openUntrustedConnection(url, timeout, null,
SSLUtil.getHostCertNormalCheck());
}
public static URLConnection openUntrustedConnection(URL url, String
clientCertAlias) throws IOException {
- return openConnection(url, 30000, clientCertAlias,
SSLUtil.getHostCertNormalCheck());
+ return openUntrustedConnection(url, 30000, clientCertAlias,
SSLUtil.getHostCertNormalCheck());
}
static URLConnection openUntrustedConnection(URL url, int timeout, String
clientCertAlias, int hostCertLevel) throws IOException {
