From e71a321305381d039e3fe637f22e1f82b3dc9e91 Mon Sep 17 00:00:00 2001 From: Vladislav Kaznacheev Date: Fri, 23 Oct 2015 18:11:55 -0700 Subject: [PATCH] Fix drag and drop URI permission grants Currently cross app drag and drop with content URIs only works for Owner. This is because the source Uid is initialized after a Binder.clearCallingIdentity call. The real source app identity is lost and things work by accident for Owner only. Bug: 25232077 Change-Id: Iaaaa735a04909a3b05fae7a7a421dbf02206cd68 --- services/core/java/com/android/server/wm/DragState.java | 1 - .../core/java/com/android/server/wm/WindowManagerService.java | 3 ++- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/services/core/java/com/android/server/wm/DragState.java b/services/core/java/com/android/server/wm/DragState.java index 352168283229a..d7fbf9283a275 100644 --- a/services/core/java/com/android/server/wm/DragState.java +++ b/services/core/java/com/android/server/wm/DragState.java @@ -77,7 +77,6 @@ class DragState { mSurfaceControl = surface; mFlags = flags; mLocalWin = localWin; - mUid = Binder.getCallingUid(); mNotifiedWindows = new ArrayList(); } diff --git a/services/core/java/com/android/server/wm/WindowManagerService.java b/services/core/java/com/android/server/wm/WindowManagerService.java index f571d9c3470ee..80b29d13cfe7a 100644 --- a/services/core/java/com/android/server/wm/WindowManagerService.java +++ b/services/core/java/com/android/server/wm/WindowManagerService.java @@ -6970,7 +6970,7 @@ public class WindowManagerService extends IWindowManager.Stub + " asbinder=" + window.asBinder()); } - final int callerPid = Binder.getCallingPid(); + final int callerUid = Binder.getCallingUid(); final long origId = Binder.clearCallingIdentity(); IBinder token = null; @@ -6995,6 +6995,7 @@ public class WindowManagerService extends IWindowManager.Stub final IBinder winBinder = window.asBinder(); token = new Binder(); mDragState = new DragState(this, token, surface, flags, winBinder); + mDragState.mUid = callerUid; token = mDragState.mToken = new Binder(); // 5 second timeout for this window to actually begin the drag