| commit | 06329e5fb214ce6c2179b7fc7740c0fba41f084a | [log] [tgz] |
|---|---|---|
| author | Carlos Valdivia <carlosvaldivia@google.com> | Sat May 07 21:46:15 2016 -0700 |
| committer | Carlos Valdivia <carlosvaldivia@google.com> | Sat May 07 21:46:15 2016 -0700 |
| tree | 94dfcf4983106c10ce8d50dcf3065d854878caed | |
| parent | dce92891df42d5ad8cdcb6ecade5b2801a14f090 [diff] |
[Security] Prevent malicious notifications from AMS. There was a hole in the getAuthToken logic that allowed notifications resulting from getAuthToken requests using notifyOnAuthFailure=true to launch arbitrary activites on the device. This is because the getAuthToken session overrode onResult (unlike addAccount, updateCreds, or confirmCreds). Bug: 13787929 Change-Id: Ife1d48835f48416c2f0690f1413a076b69215190