Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 36794e64 authored by Miao Chou's avatar Miao Chou Committed by Brint E. Kriebel
Browse files

DO NOT MERGE Fix security vulnerabilities in permission of deleting MMS/SMS

This CL adds permission check to avoid unauthorized deletion of any MMS/SMS
messages in BluetoothMapContentObserver.actionMessageSentDisconnected
function.

Bug: 22343270
Change-Id: I30254036309733be4d54db17a8ef17a571cd1c5a
Ticket: CYNGNOS-985
parent 011dbd1b
Loading
Loading
Loading
Loading
+11 −0
Original line number Diff line number Diff line
@@ -34,6 +34,7 @@ import java.util.List;

import org.xmlpull.v1.XmlSerializer;

import android.Manifest;
import android.app.Activity;
import android.app.PendingIntent;
import android.content.BroadcastReceiver;
@@ -43,11 +44,14 @@ import android.content.ContentValues;
import android.content.Context;
import android.content.Intent;
import android.content.IntentFilter;
import android.content.pm.PackageManager;
import android.database.ContentObserver;
import android.database.Cursor;
import android.net.Uri;
import android.text.format.Time;
import android.os.Binder;
import android.os.Handler;
import android.os.Process;
import android.provider.BaseColumns;
import android.provider.Telephony;
import android.provider.Telephony.Mms;
@@ -1197,6 +1201,13 @@ public class BluetoothMapContentObserver {

        private void actionMessageSent(Context context, Intent intent,
            PushMsgInfo msgInfo) {
            /* Check permission for message deletion. */
            if (context.checkCallingOrSelfPermission(android.Manifest.permission.WRITE_SMS)
                  != PackageManager.PERMISSION_GRANTED) {
                Log.w(TAG, "actionMessageSent: Not allowed to delete SMS/MMS messages");
                return;
            }

            int result = getResultCode();
            boolean delete = false;