Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e95b2c6c authored by Edgar Wang's avatar Edgar Wang Committed by Automerger Merge Worker
Browse files

Fix bypass CALL_PRIVILEGED permission in AppRestrictionsFragment am: dc44d01a 

Original change: https://googleplex-android-review.googlesource.com/c/platform/packages/apps/Settings/+/16579586

Change-Id: I3311a1514d0edeca1011642e2a368b7aa6eeb170
parents 6f8ba573 dc44d01a

src/com/android/settings/users/AppRestrictionsFragment.java

+17 −7
Original line number Diff line number Diff line
@@ -18,6 +18,7 @@ package com.android.settings.users; 


import android.app.Activity;

import android.app.settings.SettingsEnums;

import android.content.ActivityNotFoundException;

import android.content.BroadcastReceiver;

import android.content.Context;

import android.content.Intent;
@@ -37,6 +38,7 @@ import android.os.RemoteException; 
import android.os.ServiceManager;

import android.os.UserHandle;

import android.os.UserManager;

import android.util.EventLog;

import android.util.Log;

import android.view.View;

import android.view.View.OnClickListener;
@@ -641,7 +643,15 @@ public class AppRestrictionsFragment extends SettingsPreferenceFragment implemen 
            } else if (restrictionsIntent != null) {

                preference.setRestrictions(restrictions);

                if (invokeIfCustom && AppRestrictionsFragment.this.isResumed()) {

                    try {

                        assertSafeToStartCustomActivity(restrictionsIntent);

                    } catch (ActivityNotFoundException | SecurityException e) {

                        // return without startActivity

                        Log.e(TAG, "Cannot start restrictionsIntent " + e);

                        EventLog.writeEvent(0x534e4554, "200688991", -1 /* UID */, "");

                        return;

                    }



                    int requestCode = generateCustomActivityRequestCode(

                            RestrictionsResultReceiver.this.preference);

                    AppRestrictionsFragment.this.startActivityForResult(
@@ -655,14 +665,14 @@ public class AppRestrictionsFragment extends SettingsPreferenceFragment implemen 
            if (intent.getPackage() != null && intent.getPackage().equals(packageName)) {

                return;

            }

            // Activity can be started if intent resolves to multiple activities

            List<ResolveInfo> resolveInfos = AppRestrictionsFragment.this.mPackageManager

                    .queryIntentActivities(intent, 0 /* no flags */);

            if (resolveInfos.size() != 1) {

                return;

            ResolveInfo resolveInfo = mPackageManager.resolveActivity(

                    intent, PackageManager.MATCH_DEFAULT_ONLY);



            if (resolveInfo == null) {

                throw new ActivityNotFoundException("No result for resolving " + intent);

            }

            // Prevent potential privilege escalation

            ActivityInfo activityInfo = resolveInfos.get(0).activityInfo;

            ActivityInfo activityInfo = resolveInfo.activityInfo;

            if (!packageName.equals(activityInfo.packageName)) {

                throw new SecurityException("Application " + packageName

                        + " is not allowed to start activity " + intent);