Fix issue #8470131: Process thrash kills battery
Protect app widget broadcasts from abuse.
In this case the app was sending an APPWIDGET_UPDATE broadcast
without specifying a target, which (a) should not be allowed (you
should not be able to send updates to other apps), and (b) resulted
in every single potential app widget in the system being launched...
which was about 75 of them.
Change-Id: I9d48733610ce6d5a7c32e69a3e06b9f33bd79a34
diff --git a/core/java/android/appwidget/AppWidgetManager.java b/core/java/android/appwidget/AppWidgetManager.java
index e68d23a..1166e4b 100644
--- a/core/java/android/appwidget/AppWidgetManager.java
+++ b/core/java/android/appwidget/AppWidgetManager.java
@@ -49,8 +49,8 @@
static final String TAG = "AppWidgetManager";
/**
- * Send this from your {@link AppWidgetHost} activity when you want to pick an AppWidget to display.
- * The AppWidget picker activity will be launched.
+ * Activity action to launch from your {@link AppWidgetHost} activity when you want to
+ * pick an AppWidget to display. The AppWidget picker activity will be launched.
* <p>
* You must supply the following extras:
* <table>
@@ -89,8 +89,8 @@
ACTION_KEYGUARD_APPWIDGET_PICK = "android.appwidget.action.KEYGUARD_APPWIDGET_PICK";
/**
- * Send this from your {@link AppWidgetHost} activity when you want to bind an AppWidget to
- * display and bindAppWidgetIdIfAllowed returns false.
+ * Activity action to launch from your {@link AppWidgetHost} activity when you want to bind
+ * an AppWidget to display and bindAppWidgetIdIfAllowed returns false.
* <p>
* You must supply the following extras:
* <table>
@@ -269,6 +269,9 @@
/**
* Sent when the custom extras for an AppWidget change.
*
+ * <p class="note">This is a protected intent that can only be sent
+ * by the system.
+ *
* @see AppWidgetProvider#onAppWidgetOptionsChanged
* AppWidgetProvider.onAppWidgetOptionsChanged(Context context,
* AppWidgetManager appWidgetManager, int appWidgetId, Bundle newExtras)
@@ -278,6 +281,9 @@
/**
* Sent when an instance of an AppWidget is deleted from its host.
*
+ * <p class="note">This is a protected intent that can only be sent
+ * by the system.
+ *
* @see AppWidgetProvider#onDeleted AppWidgetProvider.onDeleted(Context context, int[] appWidgetIds)
*/
public static final String ACTION_APPWIDGET_DELETED = "android.appwidget.action.APPWIDGET_DELETED";
@@ -285,6 +291,9 @@
/**
* Sent when an instance of an AppWidget is removed from the last host.
*
+ * <p class="note">This is a protected intent that can only be sent
+ * by the system.
+ *
* @see AppWidgetProvider#onEnabled AppWidgetProvider.onEnabled(Context context)
*/
public static final String ACTION_APPWIDGET_DISABLED = "android.appwidget.action.APPWIDGET_DISABLED";
@@ -294,6 +303,9 @@
* This broadcast is sent at boot time if there is a AppWidgetHost installed with
* an instance for this provider.
*
+ * <p class="note">This is a protected intent that can only be sent
+ * by the system.
+ *
* @see AppWidgetProvider#onEnabled AppWidgetProvider.onEnabled(Context context)
*/
public static final String ACTION_APPWIDGET_ENABLED = "android.appwidget.action.APPWIDGET_ENABLED";
diff --git a/core/res/AndroidManifest.xml b/core/res/AndroidManifest.xml
index be8f5f4..9eca0ce 100644
--- a/core/res/AndroidManifest.xml
+++ b/core/res/AndroidManifest.xml
@@ -74,6 +74,11 @@
<protected-broadcast android:name="android.app.action.ENTER_DESK_MODE" />
<protected-broadcast android:name="android.app.action.EXIT_DESK_MODE" />
+ <protected-broadcast android:name="android.appwidget.action.APPWIDGET_UPDATE_OPTIONS" />
+ <protected-broadcast android:name="android.appwidget.action.APPWIDGET_DELETED" />
+ <protected-broadcast android:name="android.appwidget.action.APPWIDGET_DISABLED" />
+ <protected-broadcast android:name="android.appwidget.action.APPWIDGET_ENABLED" />
+
<protected-broadcast android:name="android.backup.intent.RUN" />
<protected-broadcast android:name="android.backup.intent.CLEAR" />
<protected-broadcast android:name="android.backup.intent.INIT" />