From 30b320c95dacd166648beb388ceb7dd273e72e5a Mon Sep 17 00:00:00 2001
From: Sean Barbeau <sjbarbeau@gmail.com>
Date: Tue, 28 Jan 2020 12:52:31 -0500
Subject: [PATCH] Fix #992 - Target API Level 28 (Android 9.0)

Also update custom server testing docs to reflect need to use HTTPS
---
 CUSTOM_SERVERS.md               | 12 +++++++++---
 onebusaway-android/build.gradle |  2 +-
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/CUSTOM_SERVERS.md b/CUSTOM_SERVERS.md
index 17fce2279..25d649160 100644
--- a/CUSTOM_SERVERS.md
+++ b/CUSTOM_SERVERS.md
@@ -5,7 +5,7 @@ this feature to try out a new test server that you've set up, but aren't ready t
 
 Before doing anything, check out the [system architecture diagrams](SYSTEM_ARCHITECTURE.md) to understand how OBA Android communicates with other servers. and what features they provide.
 
-Also, note that while you can test your OBA server with a HTTP URL, you'll need to enable SSL for HTTPS before launching in the Regions API.
+Also, note that while you can test your OBA server with a HTTP URL (see section below), you'll need to enable SSL for HTTPS before launching in the Regions API.
  
 ## Configuration
 
@@ -16,14 +16,20 @@ In the app, go to "Settings->Advanced".  You should see a screen like:
 You can use the following directions to add a custom OneBusAway API server and/or a custom OpenTripPlanner
 server.  After entering the server name and path, hit the back button twice to exit the Settings screen, and the app will re-initialize with the new URL(s).
 
+### Testing without SSL
+
+We strongly encourage you to configure your server to use SSL for secure communication via HTTPS - this is required for launching as a new region in the Regions API due to requirements in Android and iOS.
+
+If you want to test a server without SSL enabled, you'll need to build your own version of this app with an edited [`onebusaway-android/src/main/res/xml/network_security_config.xml`](onebusaway-android/src/main/res/xml/network_security_config.xml) file to add an exception for your server. This is an Android restriction for plain text HTTP communication - see https://developer.android.com/training/articles/security-config for details.
+
 ### OneBusAway API Server
 
 You can enter a server URL in a few different formats, including:
 
 * `example.onebusaway.org`
 * `example.onebusaway.org/onebusaway-api-webapp` (if you deployed to the default path)
-* `http://example.onebusaway.org`
-* `http://example.onebusaway.org/onebusaway-api-webapp`
+* `https://example.onebusaway.org`
+* `https://example.onebusaway.org/onebusaway-api-webapp`
 
 ### OpenTripPlanner API Server
 
diff --git a/onebusaway-android/build.gradle b/onebusaway-android/build.gradle
index e4a143436..115fba27b 100644
--- a/onebusaway-android/build.gradle
+++ b/onebusaway-android/build.gradle
@@ -52,7 +52,7 @@ android {
 
     defaultConfig {
         minSdkVersion 16
-        targetSdkVersion 26
+        targetSdkVersion 28
         versionCode 116
         versionName "2.6.7"