commit b5383455b6cae093e60684b4f5cccb0cc440330d
author Jim Miller <jaggies@google.com> Wed Apr 13 16:35:36 2016 -0700
committer Jim Miller <jaggies@google.com> Wed Apr 20 16:54:18 2016 -0700
tree 775a2a46fc6c2da1e008744caacb54273ea8c6d2
parent 825b7134699fbaaa16423c52b7b424d4a9afefb1

Fix missing permission check when saving pattern/password

Fixes bug 28163930

Change-Id: Ic98ef20933b352159b88fdef331e83e9ef6e1f20

services/core/java/com/android/server/LockSettingsService.java

diff --git a/services/core/java/com/android/server/LockSettingsService.java b/services/core/java/com/android/server/LockSettingsService.java
index 5e2fe5a..fd8916b 100644
--- a/services/core/java/com/android/server/LockSettingsService.java
+++ b/services/core/java/com/android/server/LockSettingsService.java
@@ -417,6 +417,7 @@
     @Override
     public void setLockPattern(String pattern, String savedCredential, int userId)
             throws RemoteException {
+        checkWritePermission(userId);
         byte[] currentHandle = getCurrentHandle(userId);
 
         if (pattern == null) {
@@ -445,6 +446,7 @@
     @Override
     public void setLockPassword(String password, String savedCredential, int userId)
             throws RemoteException {
+        checkWritePermission(userId);
         byte[] currentHandle = getCurrentHandle(userId);
 
         if (password == null) {