Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b50f8597 authored by Song Chun Fan's avatar Song Chun Fan
Browse files

[SettingsProvider] ensure URI's userId matches callingUserId 

BUG: 402140805
Test: manually
FLAG: EXEMPT bug fix

Change-Id: I5a6da7ddb04bf41c49a4c76b62567f8fc97566cc
parent 943dd43b

packages/SettingsProvider/src/com/android/providers/settings/SettingsProvider.java

+12 −2
Original line number Diff line number Diff line
@@ -2112,7 +2112,7 @@ public class SettingsProvider extends ContentProvider { 


        File cacheFile = getCacheFile(name, callingUserId);

        if (cacheFile != null) {

            if (!isValidMediaUri(name, value)) {

            if (!isValidMediaUri(name, value, callingUserId)) {

                return false;

            }

        }
@@ -2174,7 +2174,7 @@ public class SettingsProvider extends ContentProvider { 
        return true;

    }



    private boolean isValidMediaUri(String name, String uri) {

    private boolean isValidMediaUri(String name, String uri, int callingUserId) {

        if (uri != null) {

            Uri audioUri = Uri.parse(uri);

            if (Settings.AUTHORITY.equals(
@@ -2206,6 +2206,16 @@ public class SettingsProvider extends ContentProvider { 
                    Binder.restoreCallingIdentity(identity);

                }

            } else {

                // Check if the URI has a userId and if it matches the callingUserId

                final int uriUserId = ContentProvider.getUserIdFromUri(

                        audioUri, /* defaultUserId= */ callingUserId);

                if (callingUserId != uriUserId) {

                    Slog.e(LOG_TAG,

                            "mutateSystemSetting for setting: " + name + " URI: " + audioUri

                                    + " ignored: URI userId (" + uriUserId

                                    + ") does not match calling userId (" + callingUserId + ")");

                    return false;

                }

                mimeType = getContext().getContentResolver().getType(audioUri);

            }

            if (DEBUG) {