diff options
| author | Kenny Root <kroot@google.com> | 2010-12-01 11:38:41 -0800 |
|---|---|---|
| committer | Kenny Root <kroot@google.com> | 2010-12-01 11:38:41 -0800 |
| commit | e1823c84698006aa26a8c5dcfa5c4034858dfbe3 (patch) | |
| tree | 7fda448b1b9b8d74e7ef24d8da04c5d58332dcb8 | |
| parent | 6bc0865de800f4e9104f3bd4d253d9705a8fb2b5 (diff) | |
| download | android_packages_providers_DownloadProvider-e1823c84698006aa26a8c5dcfa5c4034858dfbe3.tar.gz android_packages_providers_DownloadProvider-e1823c84698006aa26a8c5dcfa5c4034858dfbe3.tar.bz2 android_packages_providers_DownloadProvider-e1823c84698006aa26a8c5dcfa5c4034858dfbe3.zip | |
Don't filter by UID for apps with ACCESS_ALL_DOWNLOADS
Old platform behavior of DownloadProvider would allow anyone with
special access to access all the downloads. New behavior is to return
/my_downloads/ on an .insert() call. For things that aren't using the
new API where DownloadInfo.getAllDownloadsUri() is accessible, make any
application with ACCESS_ALL_DOWNLOADS permission bypass the calling UID
check for /my_downloads/
Bug: 3242328
Change-Id: I536fde4525dd74066879f7c7da7fa609ff344645
| -rw-r--r-- | src/com/android/providers/downloads/DownloadProvider.java | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/src/com/android/providers/downloads/DownloadProvider.java b/src/com/android/providers/downloads/DownloadProvider.java index 6a67bc12..d97d6189 100644 --- a/src/com/android/providers/downloads/DownloadProvider.java +++ b/src/com/android/providers/downloads/DownloadProvider.java @@ -975,7 +975,9 @@ public final class DownloadProvider extends ContentProvider { if (uriMatch == MY_DOWNLOADS_ID || uriMatch == ALL_DOWNLOADS_ID) { selection.appendClause(Downloads.Impl._ID + " = ?", getDownloadIdFromUri(uri)); } - if (uriMatch == MY_DOWNLOADS || uriMatch == MY_DOWNLOADS_ID) { + if ((uriMatch == MY_DOWNLOADS || uriMatch == MY_DOWNLOADS_ID) + && getContext().checkCallingPermission(Downloads.Impl.PERMISSION_ACCESS_ALL) + != PackageManager.PERMISSION_GRANTED) { selection.appendClause( Constants.UID + "= ? OR " + Downloads.Impl.COLUMN_OTHER_UID + "= ?", Binder.getCallingUid(), Binder.getCallingPid()); |