commit 8661837ccf25eb7bb94487e936fea475f5325207
author Grant Menke <grantmenke@google.com> Thu Aug 10 17:04:22 2023 -0700
committer Grant Menke <grantmenke@google.com> Mon Aug 21 22:41:33 2023 +0000
tree bbe184a598cf1b185dbdbae7890509b8a799080f
parent 7f2b75fc93dd11edb9cf32612f127447bd5fa1b8

Ensure access to multiple call settings is restricted.

This CL check if access to mobile network configurations are restricted before displaying the button to select CdmaCallForwardOptions, GsmUmtsCallForwardOptions, GsmUmtsAdditionalCallOptions, and GsmUmtsCallBarringOptions. This reolves a security vulnerability where users were able to configure these call settings mobile network setting even after the device owner had applied the no_config_mobile_networks restriction. This CL also prevents these classes from being exported and  reverts a less thorough fix to this issue that had been previously applied.

Fixes: 277579183
Test: Manual using adb + POC malicous apk
Change-Id: I9b12cbf5d5b9a1356e7d06ae7583d6c5047db31c

src/com/android/phone/CdmaCallOptions.java

diff --git a/src/com/android/phone/CdmaCallOptions.java b/src/com/android/phone/CdmaCallOptions.java
index 6145870..e468c00 100644
--- a/src/com/android/phone/CdmaCallOptions.java
+++ b/src/com/android/phone/CdmaCallOptions.java
@@ -16,8 +16,10 @@
 
 package com.android.phone;
 
+import android.content.Context;
 import android.os.Bundle;
 import android.os.PersistableBundle;
+import android.os.UserManager;
 import android.preference.Preference;
 import android.preference.PreferenceScreen;
 import android.telephony.CarrierConfigManager;
@@ -78,9 +80,20 @@
             buttonVoicePrivacy.setEnabled(false);
         }
 
+        // If mobile network configs are restricted, then hide the mCallForwardingPref and
+        // mCallWaitingPref.
+        UserManager userManager = (UserManager) getSystemService(Context.USER_SERVICE);
+        boolean mobileNetworkConfigsRestricted =
+                userManager.hasUserRestriction(UserManager.DISALLOW_CONFIG_MOBILE_NETWORKS);
+        if (mobileNetworkConfigsRestricted) {
+            Log.i(LOG_TAG, "Mobile network configs are restricted, hiding CDMA call forwarding "
+                    + "and CDMA call waiting options.");
+        }
+
         mCallForwardingPref = getPreferenceScreen().findPreference(CALL_FORWARDING_KEY);
         if (carrierConfig != null && carrierConfig.getBoolean(
-                CarrierConfigManager.KEY_CALL_FORWARDING_VISIBILITY_BOOL)) {
+                CarrierConfigManager.KEY_CALL_FORWARDING_VISIBILITY_BOOL) &&
+                !mobileNetworkConfigsRestricted) {
             mCallForwardingPref.setIntent(
                     subInfoHelper.getIntent(CdmaCallForwardOptions.class));
         } else {
@@ -91,7 +104,8 @@
         mCallWaitingPref = (CdmaCallWaitingPreference) getPreferenceScreen()
                 .findPreference(CALL_WAITING_KEY);
         if (carrierConfig == null || !carrierConfig.getBoolean(
-                CarrierConfigManager.KEY_ADDITIONAL_SETTINGS_CALL_WAITING_VISIBILITY_BOOL)) {
+                CarrierConfigManager.KEY_ADDITIONAL_SETTINGS_CALL_WAITING_VISIBILITY_BOOL) ||
+                mobileNetworkConfigsRestricted) {
             getPreferenceScreen().removePreference(mCallWaitingPref);
             mCallWaitingPref = null;
         }