commit 211a2fff0d7da5fb460b395c4fea4d5b66a399ab
author Tsung-Mao Fang <tmfang@google.com> Mon Feb 01 17:34:46 2021 +0800
committer Tsung-Mao Fang <tmfang@google.com> Wed Feb 03 06:44:56 2021 +0000
tree 34ac031e5191e953993d45fe2960699dc61dbeb9
parent 6ec886a0e32d842ebbb83254ca4e147d7d7a2163

Fix security issue

Settings#CredentialStorage could be overlaid to
trick user into clearing all credentials.

Disallow non-system overlay on activity.

Test: Trigger the debug apk again, and no overlay
Bug: 176753731
Change-Id: I657de039d667f5aee0941336e9361ae04f056c33
Merged-In: I657de039d667f5aee0941336e9361ae04f056c33

src/com/android/settings/security/CredentialStorage.java

diff --git a/src/com/android/settings/security/CredentialStorage.java b/src/com/android/settings/security/CredentialStorage.java
index 5e64723..e0daaaa 100644
--- a/src/com/android/settings/security/CredentialStorage.java
+++ b/src/com/android/settings/security/CredentialStorage.java
@@ -44,6 +44,7 @@
 
 import com.android.internal.widget.LockPatternUtils;
 import com.android.settings.R;
+import com.android.settings.core.HideNonSystemOverlayMixin;
 import com.android.settings.password.ChooseLockSettingsHelper;
 import com.android.settings.vpn2.VpnUtils;
 
@@ -75,6 +76,7 @@
     protected void onCreate(Bundle savedState) {
         super.onCreate(savedState);
         mUtils = new LockPatternUtils(this);
+        getLifecycle().addObserver(new HideNonSystemOverlayMixin(this));
     }
 
     @Override