Merge "[SettingsProvider] verify ringtone URI before setting" into rvc-dev (94189125) · Commits · e / os / android_frameworks_base

packages/SettingsProvider/src/com/android/providers/settings/SettingsProvider.java

+31 −0

Original line number	Diff line number	Diff line
		@@ -1781,6 +1781,9 @@ public class SettingsProvider extends ContentProvider {
		cacheName = Settings.System.ALARM_ALERT_CACHE;
		}
		if (cacheName != null) {
		if (!isValidAudioUri(name, value)) {
		return false;
		}
		final File cacheFile = new File(
		getRingtoneCacheDir(owningUserId), cacheName);
		cacheFile.delete();
		@@ -1813,6 +1816,34 @@ public class SettingsProvider extends ContentProvider {
		}
		}

		private boolean isValidAudioUri(String name, String uri) {
		if (uri != null) {
		Uri audioUri = Uri.parse(uri);
		if (Settings.AUTHORITY.equals(
		ContentProvider.getAuthorityWithoutUserId(audioUri.getAuthority()))) {
		// Don't accept setting the default uri to self-referential URIs like
		// Settings.System.DEFAULT_RINGTONE_URI, which is an alias to the value of this
		// setting.
		return false;
		}
		final String mimeType = getContext().getContentResolver().getType(audioUri);
		if (mimeType == null) {
		Slog.e(LOG_TAG,
		"mutateSystemSetting for setting: " + name + " URI: " + audioUri
		+ " ignored: failure to find mimeType (no access from this context?)");
		return false;
		}
		if (!(mimeType.startsWith("audio/") \|\| mimeType.equals("application/ogg")
		\|\| mimeType.equals("application/x-flac"))) {
		Slog.e(LOG_TAG,
		"mutateSystemSetting for setting: " + name + " URI: " + audioUri
		+ " ignored: associated mimeType: " + mimeType + " is not an audio type");
		return false;
		}
		}
		return true;
		}

		private boolean hasWriteSecureSettingsPermission() {
		// Write secure settings is a more protected permission. If caller has it we are good.
		if (getContext().checkCallingOrSelfPermission(Manifest.permission.WRITE_SECURE_SETTINGS)