commit 66026773bbf1d7631743a5b892a4f768c694f868
author Amith Yamasani <yamasani@google.com> Wed Sep 25 14:05:33 2013 -0700
committer Amith Yamasani <yamasani@google.com> Wed Sep 25 14:05:33 2013 -0700
tree 09729d1c9ac54e66a86e09550a9b4aafbd2bb295
parent 8243c9a722e815bdcb069163de48877478c28dfd

Make sure that external callers cannot pass in the confirm bypass extra

Security fix for vulnerability where an app could launch into the screen lock
change dialog without first confirming the existing password/pattern.

Also, make sure that the fragments are launched with the correct corresponding
activity.

Bug: 9858403
Change-Id: I0f2c00a44abeb624c6fba0497bf6036a6f1a4564

AndroidManifest.xml

diff --git a/AndroidManifest.xml b/AndroidManifest.xml
index 6b03d51..a34479d 100644
--- a/AndroidManifest.xml
+++ b/AndroidManifest.xml
@@ -1035,7 +1035,6 @@
 
         <!-- Second and third-level settings -->
 
-
         <!-- Lock screen settings -->
         <activity android:name="ConfirmLockPattern"/>
 
@@ -1051,6 +1050,11 @@
             </intent-filter>
         </activity>
 
+        <activity android:name="ChooseLockGeneric$InternalActivity" android:exported="false"
+            android:label="@string/lockpassword_choose_lock_generic_header"
+            android:excludeFromRecents="true"
+        />
+
         <activity android:name="ChooseLockPattern" android:exported="false"/>
 
         <activity android:name="ChooseLockPassword" android:exported="false"