diff options
author | Svetoslav Ganov <svetoslavganov@google.com> | 2016-07-18 13:31:39 -0700 |
---|---|---|
committer | Svetoslav Ganov <svetoslavganov@google.com> | 2016-07-18 13:31:42 -0700 |
commit | b0ce821e7d0f9cffb95575c748201af51ec45faa (patch) | |
tree | f9d212ee85fa1764534cac0e5a92a41fb304a772 /src | |
parent | 0f8ca3cd2801e43b17c59cdd0e1377b5ef5602a8 (diff) | |
download | android_packages_apps_PackageInstaller-b0ce821e7d0f9cffb95575c748201af51ec45faa.tar.gz android_packages_apps_PackageInstaller-b0ce821e7d0f9cffb95575c748201af51ec45faa.tar.bz2 android_packages_apps_PackageInstaller-b0ce821e7d0f9cffb95575c748201af51ec45faa.zip |
Remove lefover secure button
An incorrect fix for a security bug where apps with
overlay access can redress the permission message added
a secure button implementation that refuses interaction
if the window is covered. While this was fixed in M
branches we did not merge the change in NYC because
we now hide all overlays. However, the app op which
controls overlays allows privileged apps to bypass the
app op. It is fine to have priv apps overlay stuff on
top of the permissions UI except that the allow button
show be clickable. This change removes the offending
code.
bug:29879858
Change-Id: I9d0b5e62b5ef029069e37f34dbcd90d4909d966b
Diffstat (limited to 'src')
-rw-r--r-- | src/com/android/packageinstaller/permission/ui/SecureButtonView.java | 56 |
1 files changed, 0 insertions, 56 deletions
diff --git a/src/com/android/packageinstaller/permission/ui/SecureButtonView.java b/src/com/android/packageinstaller/permission/ui/SecureButtonView.java deleted file mode 100644 index 624744e5..00000000 --- a/src/com/android/packageinstaller/permission/ui/SecureButtonView.java +++ /dev/null @@ -1,56 +0,0 @@ -/* - * Copyright (C) 2016 The Android Open Source Project - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -package com.android.packageinstaller.permission.ui; - -import android.content.Context; -import android.util.AttributeSet; -import android.view.MotionEvent; -import android.widget.Button; - -/** - * Extension of Button that uses the hidden MotionEvent flag for partially obscured windows to - * prevent tapjacking attacks. - */ -public class SecureButtonView extends Button { - - public SecureButtonView(Context context) { - this(context, null); - } - - public SecureButtonView(Context context, AttributeSet attrs) { - this(context, attrs, 0); - } - - public SecureButtonView(Context context, AttributeSet attrs, int defStyleAttr) { - this(context, attrs, defStyleAttr, 0); - } - - public SecureButtonView(Context context, AttributeSet attrs, int defStyleAttr, - int defStyleRes) { - super(context, attrs, defStyleAttr, defStyleRes); - } - - @Override - public boolean onFilterTouchEventForSecurity(MotionEvent event) { - if ((event.getFlags() & MotionEvent.FLAG_WINDOW_IS_OBSCURED) != 0 - || (event.getFlags() & MotionEvent.FLAG_WINDOW_IS_PARTIALLY_OBSCURED) != 0) { - // Window is obscured, drop this touch. - return false; - } - return true; - } -} |