From 9a69f10556fcd7e600f862992e1e16d69b34cb48 Mon Sep 17 00:00:00 2001 From: Kenny Root Date: Wed, 1 Dec 2010 11:38:41 -0800 Subject: Don't filter by UID for apps with ACCESS_ALL_DOWNLOADS Old platform behavior of DownloadProvider would allow anyone with special access to access all the downloads. New behavior is to return /my_downloads/ on an .insert() call. For things that aren't using the new API where DownloadInfo.getAllDownloadsUri() is accessible, make any application with ACCESS_ALL_DOWNLOADS permission bypass the calling UID check for /my_downloads/ Bug: 3242328 Change-Id: I4d7dae75c528d2803d594c5d79d19865ef37ed30 --- src/com/android/providers/downloads/DownloadProvider.java | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/com/android/providers/downloads/DownloadProvider.java b/src/com/android/providers/downloads/DownloadProvider.java index 6a67bc12..d97d6189 100644 --- a/src/com/android/providers/downloads/DownloadProvider.java +++ b/src/com/android/providers/downloads/DownloadProvider.java @@ -975,7 +975,9 @@ public final class DownloadProvider extends ContentProvider { if (uriMatch == MY_DOWNLOADS_ID || uriMatch == ALL_DOWNLOADS_ID) { selection.appendClause(Downloads.Impl._ID + " = ?", getDownloadIdFromUri(uri)); } - if (uriMatch == MY_DOWNLOADS || uriMatch == MY_DOWNLOADS_ID) { + if ((uriMatch == MY_DOWNLOADS || uriMatch == MY_DOWNLOADS_ID) + && getContext().checkCallingPermission(Downloads.Impl.PERMISSION_ACCESS_ALL) + != PackageManager.PERMISSION_GRANTED) { selection.appendClause( Constants.UID + "= ? OR " + Downloads.Impl.COLUMN_OTHER_UID + "= ?", Binder.getCallingUid(), Binder.getCallingPid()); -- cgit v1.2.3