Browse Source

remove check for package name as it can be faked easily

David Luhmer 6 years ago
parent
commit
57e7eee9ff
1 changed files with 0 additions and 14 deletions
  1. 0 14
      src/main/java/com/nextcloud/android/sso/InputStreamBinder.java

+ 0 - 14
src/main/java/com/nextcloud/android/sso/InputStreamBinder.java

@@ -26,7 +26,6 @@ import android.accounts.AuthenticatorException;
 import android.accounts.OperationCanceledException;
 import android.accounts.OperationCanceledException;
 import android.content.Context;
 import android.content.Context;
 import android.content.SharedPreferences;
 import android.content.SharedPreferences;
-import android.os.Binder;
 import android.os.ParcelFileDescriptor;
 import android.os.ParcelFileDescriptor;
 import android.util.Log;
 import android.util.Log;
 
 
@@ -56,9 +55,6 @@ import java.io.InputStream;
 import java.io.ObjectInputStream;
 import java.io.ObjectInputStream;
 import java.io.ObjectOutputStream;
 import java.io.ObjectOutputStream;
 import java.io.Serializable;
 import java.io.Serializable;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.List;
 import java.util.Map;
 import java.util.Map;
 
 
 import static com.nextcloud.android.sso.Constants.EXCEPTION_ACCOUNT_NOT_FOUND;
 import static com.nextcloud.android.sso.Constants.EXCEPTION_ACCOUNT_NOT_FOUND;
@@ -78,11 +74,6 @@ public class InputStreamBinder extends IInputStreamService.Stub {
     private static final char PATH_SEPARATOR = '/';
     private static final char PATH_SEPARATOR = '/';
     private Context context;
     private Context context;
 
 
-    private List<String> validPackages = new ArrayList<>(Arrays.asList(
-            "de.luhmer.owncloudnewsreader"
-            //"it.niedermann.owncloud.notes"
-    ));
-
     public InputStreamBinder(Context context) {
     public InputStreamBinder(Context context) {
         this.context = context;
         this.context = context;
     }
     }
@@ -217,11 +208,6 @@ public class InputStreamBinder extends IInputStreamService.Stub {
     }
     }
 
 
     private boolean isValid(NextcloudRequest request) {
     private boolean isValid(NextcloudRequest request) {
-        if(request.packageName == null) {
-            String callingPackageName = context.getPackageManager().getNameForUid(Binder.getCallingUid());
-            request.packageName = callingPackageName;
-        }
-
         SharedPreferences sharedPreferences = PreferenceManager.getDefaultSharedPreferences(context);
         SharedPreferences sharedPreferences = PreferenceManager.getDefaultSharedPreferences(context);
         String storedToken = sharedPreferences.getString(request.packageName, "");
         String storedToken = sharedPreferences.getString(request.packageName, "");
         return validPackages.contains(request.packageName) && request.token.equals(storedToken);
         return validPackages.contains(request.packageName) && request.token.equals(storedToken);