Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ed0866eb authored by Phil Weaver's avatar Phil Weaver
Browse files

Fix clickjacking again for accessibility services 

Turns out that the flag for the window being obscured
does not imply that it is also partially obscured.

Also blocking system alerts and toast windows over the
accessibility service preference screen (and its associated
warning dialog) as well as the warning dialog shown when
a service is made available with the accessibiity shortcut.

Bug: 62104030
Test: Manually verified that I can't enable Select to Speak
when switch access is highlighting the button. I am able to
do that without this fix. Also started a service that
displayed a system overlay and confirmed that the overlay
disappears on a11y service preference screens and when a
new service is configured for the a11y shortcut.
Merged-In: Ie00bafa736c837881a258c9de10891b27c5baefd

Change-Id: Iabbded1a12dbc33d76e51c0bac710280a88080f3
parent 20ae31e8

AndroidManifest.xml

+1 −0
Original line number Diff line number Diff line
@@ -81,6 +81,7 @@ 
    <uses-permission android:name="android.permission.PEERS_MAC_ADDRESS"/>

    <uses-permission android:name="android.permission.MANAGE_NOTIFICATIONS"/>

    <uses-permission android:name="android.permission.DELETE_PACKAGES"/>

    <uses-permission android:name="android.permission.MANAGE_APP_OPS_RESTRICTIONS"/>



    <application android:label="@string/settings_label"

            android:icon="@drawable/ic_launcher_settings"

src/com/android/settings/Utils.java

+17 −0
Original line number Diff line number Diff line
@@ -25,6 +25,7 @@ import android.annotation.Nullable; 
import android.app.ActivityManager;

import android.app.AlertDialog;

import android.app.AppGlobals;

import android.app.AppOpsManager;

import android.app.Dialog;

import android.app.Fragment;

import android.app.IActivityManager;
@@ -1272,6 +1273,22 @@ public final class Utils extends com.android.settingslib.Utils { 
        return info.enabled ? R.string.installed : R.string.disabled;

    }



    /**

     * Control if other apps can display overlays. By default this is allowed. Be sure to

     * re-enable overlays, as the effect is system-wide.

     */

    public static void setOverlayAllowed(Context context, IBinder token, boolean allowed) {

        AppOpsManager appOpsManager = context.getSystemService(AppOpsManager.class);

        if (appOpsManager != null) {

            appOpsManager.setUserRestriction(AppOpsManager.OP_SYSTEM_ALERT_WINDOW,

                    !allowed, token);

            appOpsManager.setUserRestriction(AppOpsManager.OP_TOAST_WINDOW,

                    !allowed, token);

        }

    }







    private static boolean isVolumeValid(VolumeInfo volume) {

        return (volume != null) && (volume.getType() == VolumeInfo.TYPE_PRIVATE)

                && volume.isMountedReadable();

src/com/android/settings/accessibility/AccessibilityServiceWarning.java

+4 −2
Original line number Diff line number Diff line
@@ -48,14 +48,14 @@ public class AccessibilityServiceWarning { 
                .setTitle(parentActivity.getString(R.string.enable_service_title,

                        getServiceName(parentActivity, info)))

                .setView(createEnableDialogContentView(parentActivity, info))

                .setCancelable(true)

                .setPositiveButton(android.R.string.ok, listener)

                .setNegativeButton(android.R.string.cancel, listener)

                .create();



        final View.OnTouchListener filterTouchListener = (View v, MotionEvent event) -> {

            // Filter obscured touches by consuming them.

            if ((event.getFlags() & MotionEvent.FLAG_WINDOW_IS_PARTIALLY_OBSCURED) != 0) {

            if (((event.getFlags() & MotionEvent.FLAG_WINDOW_IS_OBSCURED) != 0)

                || ((event.getFlags() & MotionEvent.FLAG_WINDOW_IS_PARTIALLY_OBSCURED) != 0)) {

                if (event.getAction() == MotionEvent.ACTION_UP) {

                    Toast.makeText(v.getContext(), R.string.touch_filtered_warning,

                            Toast.LENGTH_SHORT).show();
@@ -67,6 +67,8 @@ public class AccessibilityServiceWarning { 


        ad.create();

        ad.getButton(AlertDialog.BUTTON_POSITIVE).setOnTouchListener(filterTouchListener);

        ad.setCanceledOnTouchOutside(true);



        return ad;

    }

src/com/android/settings/accessibility/ShortcutServicePickerFragment.java

+22 −5
Original line number Diff line number Diff line
@@ -17,25 +17,24 @@ package com.android.settings.accessibility; 


import static android.content.DialogInterface.BUTTON_POSITIVE;



import static com.android.settings.Utils.setOverlayAllowed;



import android.accessibilityservice.AccessibilityServiceInfo;

import android.app.Activity;

import android.app.AlertDialog;

import android.app.Dialog;

import android.app.DialogFragment;

import android.app.Fragment;

import android.content.ComponentName;

import android.content.DialogInterface;

import android.content.pm.PackageManager;

import android.content.pm.PackageParser;

import android.os.Binder;

import android.os.Bundle;

import android.os.IBinder;

import android.os.UserHandle;

import android.provider.Settings;

import android.support.v7.preference.Preference;

import android.text.TextUtils;

import android.view.accessibility.AccessibilityManager;



import com.android.internal.logging.nano.MetricsProto.MetricsEvent;

import com.android.settings.DialogCreatable;

import com.android.settings.applications.defaultapps.DefaultAppInfo;

import com.android.settings.applications.defaultapps.DefaultAppPickerFragment;

import com.android.settings.core.instrumentation.InstrumentedDialogFragment;
@@ -118,6 +117,7 @@ public class ShortcutServicePickerFragment extends DefaultAppPickerFragment { 
            implements DialogInterface.OnClickListener {

        private static final String EXTRA_KEY = "extra_key";

        private static final String TAG = "ConfirmationDialogFragment";

        private IBinder mToken;



        public static ConfirmationDialogFragment newInstance(ShortcutServicePickerFragment parent,

                String key) {
@@ -126,6 +126,7 @@ public class ShortcutServicePickerFragment extends DefaultAppPickerFragment { 
            argument.putString(EXTRA_KEY, key);

            fragment.setArguments(argument);

            fragment.setTargetFragment(parent, 0);

            fragment.mToken = new Binder();

            return fragment;

        }
@@ -146,6 +147,22 @@ public class ShortcutServicePickerFragment extends DefaultAppPickerFragment { 
            return AccessibilityServiceWarning.createCapabilitiesDialog(getActivity(), info, this);

        }



        @Override

        public void onResume() {

            super.onResume();

            if (mToken != null) {

                setOverlayAllowed(getActivity(), mToken, false);

            }

        }



        @Override

        public void onPause() {

            super.onPause();

            if (mToken != null) {

                setOverlayAllowed(getActivity(), mToken, true);

            }

        }



        @Override

        public void onClick(DialogInterface dialog, int which) {

            final Fragment fragment = getTargetFragment();

src/com/android/settings/accessibility/ToggleAccessibilityServicePreferenceFragment.java

+12 −8
Original line number Diff line number Diff line
@@ -16,34 +16,30 @@ 


package com.android.settings.accessibility;



import static com.android.settings.Utils.setOverlayAllowed;



import android.accessibilityservice.AccessibilityServiceInfo;

import android.app.Activity;

import android.app.AlertDialog;

import android.app.Dialog;

import android.app.admin.DevicePolicyManager;

import android.content.ComponentName;

import android.content.Context;

import android.content.DialogInterface;

import android.content.Intent;

import android.content.pm.ResolveInfo;

import android.net.Uri;

import android.os.Binder;

import android.os.Bundle;

import android.os.Handler;

import android.os.IBinder;

import android.os.UserHandle;

import android.os.storage.StorageManager;

import android.provider.Settings;

import android.text.TextUtils;

import android.view.LayoutInflater;

import android.view.Menu;

import android.view.MenuInflater;

import android.view.MenuItem;

import android.view.MotionEvent;

import android.view.View;

import android.view.accessibility.AccessibilityManager;

import android.widget.ImageView;

import android.widget.LinearLayout;

import android.widget.TextView;

import android.widget.Toast;



import com.android.internal.logging.nano.MetricsProto.MetricsEvent;

import com.android.internal.widget.LockPatternUtils;
@@ -77,6 +73,8 @@ public class ToggleAccessibilityServicePreferenceFragment 


    private int mShownDialogId;



    private final IBinder mToken = new Binder();



    @Override

    public int getMetricsCategory() {

        return MetricsEvent.ACCESSIBILITY_SERVICE;
@@ -107,12 +105,18 @@ public class ToggleAccessibilityServicePreferenceFragment 
    public void onResume() {

        mSettingsContentObserver.register(getContentResolver());

        updateSwitchBarToggleSwitch();

        if (mToken != null) {

            setOverlayAllowed(getActivity(), mToken, false);

        }

        super.onResume();

    }



    @Override

    public void onPause() {

        mSettingsContentObserver.unregister(getContentResolver());

        if (mToken != null) {

            setOverlayAllowed(getActivity(), mToken, true);

        }

        super.onPause();

    }