Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Only return password for account session flow if the caller is signed with system key and have get_password permission. am: 9342e137c6 am: 8b75ebf0bb

Browse Source 
am: adc906206a

Change-Id: I3c9aee82df05e9a74eed960c1d03ea5d9fe477d7
This commit is contained in:
Hongming Jin
2016-09-14 23:44:52 +00:00
committed by android-build-merger
parent 2c74e4f719 adc906206a
commit afe9a6c768
2 changed files with 6 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
core/java/android/accounts/AccountManager.java
View File

@@ -2703,8 +2703,6 @@ public class AccountManager {
* <ul> * <ul>
* <li>{@link #KEY_ACCOUNT_SESSION_BUNDLE} - encrypted Bundle for * <li>{@link #KEY_ACCOUNT_SESSION_BUNDLE} - encrypted Bundle for
* adding the the to the device later. * adding the the to the device later.
* <li>{@link #KEY_PASSWORD} - optional, the password or password
* hash of the account.
* <li>{@link #KEY_ACCOUNT_STATUS_TOKEN} - optional, token to check * <li>{@link #KEY_ACCOUNT_STATUS_TOKEN} - optional, token to check
* status of the account * status of the account
* </ul> * </ul>
@@ -2792,8 +2790,6 @@ public class AccountManager {
* <ul> * <ul>
* <li>{@link #KEY_ACCOUNT_SESSION_BUNDLE} - encrypted Bundle for * <li>{@link #KEY_ACCOUNT_SESSION_BUNDLE} - encrypted Bundle for
* updating the local credentials on device later. * updating the local credentials on device later.
* <li>{@link #KEY_PASSWORD} - optional, the password or password
* hash of the account
* <li>{@link #KEY_ACCOUNT_STATUS_TOKEN} - optional, token to check * <li>{@link #KEY_ACCOUNT_STATUS_TOKEN} - optional, token to check
* status of the account * status of the account
* </ul> * </ul>

12
services/core/java/com/android/server/accounts/AccountManagerService.java
View File

@@ -2852,10 +2852,9 @@ public class AccountManagerService
boolean isPasswordForwardingAllowed = isPermitted( boolean isPasswordForwardingAllowed = isPermitted(
callerPkg, uid, Manifest.permission.GET_PASSWORD); callerPkg, uid, Manifest.permission.GET_PASSWORD);
int usrId = UserHandle.getCallingUserId();
long identityToken = clearCallingIdentity(); long identityToken = clearCallingIdentity();
try { try {
UserAccounts accounts = getUserAccounts(usrId); UserAccounts accounts = getUserAccounts(userId);
logRecordWithUid(accounts, DebugDbHelper.ACTION_CALLED_START_ACCOUNT_ADD, logRecordWithUid(accounts, DebugDbHelper.ACTION_CALLED_START_ACCOUNT_ADD,
TABLE_ACCOUNTS, uid); TABLE_ACCOUNTS, uid);
new StartAccountSession( new StartAccountSession(
@@ -2916,10 +2915,6 @@ public class AccountManagerService
checkKeyIntent( checkKeyIntent(
Binder.getCallingUid(), Binder.getCallingUid(),
intent); intent);
// Omit passwords if the caller isn't permitted to see them.
if (!mIsPasswordForwardingAllowed) {
result.remove(AccountManager.KEY_PASSWORD);
}
} }
IAccountManagerResponse response; IAccountManagerResponse response;
if (mExpectActivityLaunch && result != null if (mExpectActivityLaunch && result != null
@@ -2949,6 +2944,11 @@ public class AccountManagerService
return; return;
} }
// Omit passwords if the caller isn't permitted to see them.
if (!mIsPasswordForwardingAllowed) {
result.remove(AccountManager.KEY_PASSWORD);
}
// Strip auth token from result. // Strip auth token from result.
result.remove(AccountManager.KEY_AUTHTOKEN); result.remove(AccountManager.KEY_AUTHTOKEN);