Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d2c71467 authored by Anna Bauza's avatar Anna Bauza Committed by Nolen Johnson
Browse files

fix: Security Report - Reveal images across users via EditUserPhotoController 

This functionality has implemented tests on t+ branches.

Bug: 296915959
Test: N/A
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:ae74e70c36ec027dd55164880d8b7225be4c85a3)
Merged-In: If79af734432b14be74815a47e1026dc8369a304f
Change-Id: If79af734432b14be74815a47e1026dc8369a304f

Change-Id: I95416b6b557d9bcf69a4211af707abf85809e4da
parent 9b13af4c

src/com/android/settings/users/EditUserPhotoController.java

+7 −0
Original line number Diff line number Diff line
@@ -18,6 +18,7 @@ package com.android.settings.users; 


import android.app.Activity;

import android.content.ClipData;

import android.content.ContentProvider;

import android.content.ContentResolver;

import android.content.Context;

import android.content.Intent;
@@ -132,6 +133,12 @@ public class EditUserPhotoController { 
            return false;

        }



        final int currentUserId = UserHandle.myUserId();

        if (currentUserId != ContentProvider.getUserIdFromUri(pictureUri, currentUserId)) {

            Log.e(TAG, "Invalid pictureUri: " + pictureUri);

            return false;

        }



        switch (requestCode) {

            case REQUEST_CODE_CROP_PHOTO:

                onPhotoCropped(pictureUri, true);