From 13ceb54a1986d6889892246069fe23b574036f2f Mon Sep 17 00:00:00 2001
From: Jean-Michel Trivi <jmtrivi@google.com>
Date: Wed, 22 Jul 2015 10:55:02 -0700
Subject: [PATCH] RingtoneManager: query results depend on caller permission

When querying for ringtones, only look for ringtones on external
  storage when the caller has READ_EXTERNAL_STORAGE.
Document this behavior in the javadoc of the affected methods.

Bug 22545684

Change-Id: Iae9c9a4ccaf635da8af2ac289b6b4df1b16c5d11
---
 media/java/android/media/RingtoneManager.java | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/media/java/android/media/RingtoneManager.java b/media/java/android/media/RingtoneManager.java
index a1b8a3b6b1a8e..025029e75ec11 100644
--- a/media/java/android/media/RingtoneManager.java
+++ b/media/java/android/media/RingtoneManager.java
@@ -23,9 +23,11 @@ import android.annotation.SdkConstant.SdkConstantType;
 import android.app.Activity;
 import android.content.ContentUris;
 import android.content.Context;
+import android.content.pm.PackageManager;
 import android.database.Cursor;
 import android.net.Uri;
 import android.os.Environment;
+import android.os.Process;
 import android.provider.MediaStore;
 import android.provider.Settings;
 import android.provider.Settings.System;
@@ -359,7 +361,10 @@ public class RingtoneManager {
      * If {@link RingtoneManager#RingtoneManager(Activity)} was not used, the
      * caller should manage the returned cursor through its activity's life
      * cycle to prevent leaking the cursor.
-     * 
+     * <p>
+     * Note that the list of ringtones available will differ depending on whether the caller
+     * has the {@link android.Manifest.permission#READ_EXTERNAL_STORAGE} permission.
+     *
      * @return A {@link Cursor} of all the ringtones available.
      * @see #ID_COLUMN_INDEX
      * @see #TITLE_COLUMN_INDEX
@@ -455,8 +460,10 @@ public class RingtoneManager {
 
     /**
      * Returns a valid ringtone URI. No guarantees on which it returns. If it
-     * cannot find one, returns null.
-     * 
+     * cannot find one, returns null. If it can only find one on external storage and the caller
+     * doesn't have the {@link android.Manifest.permission#READ_EXTERNAL_STORAGE} permission,
+     * returns null.
+     *
      * @param context The context to use for querying.
      * @return A ringtone URI, or null if one cannot be found.
      */
@@ -495,6 +502,12 @@ public class RingtoneManager {
     }
 
     private Cursor getMediaRingtones() {
+        if (PackageManager.PERMISSION_GRANTED != mContext.checkPermission(
+                android.Manifest.permission.READ_EXTERNAL_STORAGE,
+                Process.myPid(), Process.myUid())) {
+            Log.w(TAG, "No READ_EXTERNAL_STORAGE permission, ignoring ringtones on ext storage");
+            return null;
+        }
          // Get the external media cursor. First check to see if it is mounted.
         final String status = Environment.getExternalStorageState();