Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d074c0e5 authored by Adnan Begovic's avatar Adnan Begovic
Browse files

fw: Provide system context to EnableAccessibilityController. 

  Every invocation audit wrapped by AppsOps will validate that the
  original context's uid matches what is being audited. Since we
  create a themed context from system ui, every attempt at flipping
  secure settings while in the GlobalActions scope would lead to
  SecurityExceptions.

  Mitigate by passing original context as well as the themed context
  and constructing the EnableAccessibilityController with the system
  context.

Change-Id: I61d8c99c9da6c7387544c77250907ff4a2ae38d8
TICKET: FEIJ-316
(cherry picked from commit 35c5005e)
parent 22b4f524

services/core/java/com/android/server/policy/GlobalActions.java

+19 −4
Original line number Diff line number Diff line
@@ -417,7 +417,8 @@ class GlobalActions implements DialogInterface.OnDismissListener, DialogInterfac 
        params.mOnClickListener = this;

        params.mForceInverseBackground = true;



        GlobalActionsDialog dialog = new GlobalActionsDialog(getUiContext(), params);

        GlobalActionsDialog dialog = new GlobalActionsDialog(/** system context **/ mContext,

                /** themed context **/ getUiContext(), params);

        dialog.setCanceledOnTouchOutside(false); // Handled by the custom class.



        dialog.getListView().setItemsCanFocus(true);
@@ -1457,6 +1458,7 @@ class GlobalActions implements DialogInterface.OnDismissListener, DialogInterfac 


    private static final class GlobalActionsDialog extends Dialog implements DialogInterface {

        private final Context mContext;

        private Context mSystemContext = null;

        private final int mWindowTouchSlop;

        private final AlertController mAlert;

        private final MyAdapter mAdapter;
@@ -1466,7 +1468,7 @@ class GlobalActions implements DialogInterface.OnDismissListener, DialogInterfac 
        private boolean mIntercepted;

        private boolean mCancelOnUp;



        public GlobalActionsDialog(Context context, AlertParams params) {

        private GlobalActionsDialog(Context context, AlertParams params) {

            super(context, getDialogTheme(context));

            mContext = getContext();

            mAlert = new AlertController(mContext, this, getWindow());
@@ -1475,6 +1477,19 @@ class GlobalActions implements DialogInterface.OnDismissListener, DialogInterfac 
            params.apply(mAlert);

        }



        /**

         * Utilized for a working global actions dialog for both accessibility services (which

         * require a system context) and

         * @param systemContext Base context (should be from system process)

         * @param themedContext Themed context (created from system ui)

         * @param params

         */

        public GlobalActionsDialog(Context systemContext, Context themedContext,

                AlertParams params) {

            this(themedContext, params);

            mSystemContext = systemContext;

        }



        private static int getDialogTheme(Context context) {

            TypedValue outValue = new TypedValue();

            context.getTheme().resolveAttribute(com.android.internal.R.attr.alertDialogTheme,
@@ -1488,8 +1503,8 @@ class GlobalActions implements DialogInterface.OnDismissListener, DialogInterfac 
            // of dismissing the dialog on touch outside. This is because the dialog

            // is dismissed on the first down while the global gesture is a long press

            // with two fingers anywhere on the screen.

            if (EnableAccessibilityController.canEnableAccessibilityViaGesture(mContext)) {

                mEnableAccessibilityController = new EnableAccessibilityController(mContext,

            if (EnableAccessibilityController.canEnableAccessibilityViaGesture(mSystemContext)) {

                mEnableAccessibilityController = new EnableAccessibilityController(mSystemContext,

                        new Runnable() {

                    @Override

                    public void run() {