From 376e4ba96222163be1f1cf409dc697550be4a285 Mon Sep 17 00:00:00 2001
From: Nicolas Prevot <nprevot@google.com>
Date: Thu, 14 Aug 2014 16:58:20 +0100
Subject: [PATCH] When forwarding intents, ignoring the package set in the
 intent.

Apps should not be allowed to target a specific package in the target user.

BUG: 17025506

Change-Id: I81afa2f8d0a1114d91c001e357366792c63b6577
---
 .../internal/app/IntentForwarderActivity.java | 10 ++++----
 .../server/pm/PackageManagerService.java      | 24 +++++++++----------
 2 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/core/java/com/android/internal/app/IntentForwarderActivity.java b/core/java/com/android/internal/app/IntentForwarderActivity.java
index af38b3e4bfded..d949375263bf7 100644
--- a/core/java/com/android/internal/app/IntentForwarderActivity.java
+++ b/core/java/com/android/internal/app/IntentForwarderActivity.java
@@ -76,17 +76,19 @@ public class IntentForwarderActivity extends Activity  {
         }
         Intent newIntent = new Intent(intentReceived);
         newIntent.setComponent(null);
+        // Apps should not be allowed to target a specific package in the target user.
+        newIntent.setPackage(null);
         newIntent.addFlags(Intent.FLAG_ACTIVITY_FORWARD_RESULT
                 |Intent.FLAG_ACTIVITY_PREVIOUS_IS_TOP);
         int callingUserId = getUserId();
         IPackageManager ipm = AppGlobals.getPackageManager();
         String resolvedType = newIntent.resolveTypeIfNeeded(getContentResolver());
         boolean canForward = false;
+        Intent selector = newIntent.getSelector();
+        if (selector == null) {
+            selector = newIntent;
+        }
         try {
-            Intent selector = newIntent.getSelector();
-            if (selector == null) {
-                selector = newIntent;
-            }
             canForward = ipm.canForwardTo(selector, resolvedType, callingUserId,
                     userDest.getIdentifier());
         } catch (RemoteException e) {
diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java
index 89bd1d4a589c0..8b4573cab2ba3 100644
--- a/services/core/java/com/android/server/pm/PackageManagerService.java
+++ b/services/core/java/com/android/server/pm/PackageManagerService.java
@@ -3192,24 +3192,22 @@ public class PackageManagerService extends IPackageManager.Stub {
                 if (matches.get(i).getTargetUserId() == targetUserId) return true;
             }
         }
-
         ArrayList<String> packageNames = null;
         SparseArray<ArrayList<String>> fromSource =
                 mSettings.mCrossProfilePackageInfo.get(sourceUserId);
         if (fromSource != null) {
             packageNames = fromSource.get(targetUserId);
-        }
-        if (packageNames != null && packageNames.contains(intent.getPackage())) {
-            return true;
-        }
-        // We need the package name, so we try to resolve with the loosest flags possible
-        List<ResolveInfo> resolveInfos = mActivities.queryIntent(
-                intent, resolvedType, PackageManager.GET_UNINSTALLED_PACKAGES, targetUserId);
-        int count = resolveInfos.size();
-        for (int i = 0; i < count; i++) {
-            ResolveInfo resolveInfo = resolveInfos.get(i);
-            if (packageNames.contains(resolveInfo.activityInfo.packageName)) {
-                return true;
+            if (packageNames != null) {
+                // We need the package name, so we try to resolve with the loosest flags possible
+                List<ResolveInfo> resolveInfos = mActivities.queryIntent(intent, resolvedType,
+                        PackageManager.GET_UNINSTALLED_PACKAGES, targetUserId);
+                int count = resolveInfos.size();
+                for (int i = 0; i < count; i++) {
+                    ResolveInfo resolveInfo = resolveInfos.get(i);
+                    if (packageNames.contains(resolveInfo.activityInfo.packageName)) {
+                        return true;
+                    }
+                }
             }
         }
         return false;