Hosting widgets getting java.lang.SecurityException: Permission Denial error

user_8213255 0
Viewed 447

I am making an app that hosts widgets and it works well except for when I add the email widget. When I do that I get a java.lang.SecurityException: Permission Denial error : starting intent.

Here is the error log:

java.lang.RuntimeException: Failure delivering result ResultInfo{who=null, request=11, result=-1, data=Intent { (has extras) }} to activity {aheschl.screenscortcut/aheschl.screenscortcut.WidgetEdge}: java.lang.SecurityException: Permission Denial: starting Intent { act=android.appwidget.action.APPWIDGET_CONFIGURE cmp=com.samsung.android.email.provider/com.samsung.android.email.widget.EmailWidgetConfig (has extras) } from ProcessRecord{af0a74c 10759:aheschl.screenscortcut/u0a319} (pid=10759, uid=10319) not exported from uid 10033
                                                                        at android.app.ActivityThread.deliverResults(ActivityThread.java:4926)
                                                                        at android.app.ActivityThread.handleSendResult(ActivityThread.java:4969)
                                                                        at android.app.ActivityThread.access$1600(ActivityThread.java:222)
                                                                        at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1850)
                                                                        at android.os.Handler.dispatchMessage(Handler.java:102)
                                                                        at android.os.Looper.loop(Looper.java:158)
                                                                        at android.app.ActivityThread.main(ActivityThread.java:7230)
                                                                        at java.lang.reflect.Method.invoke(Native Method)
                                                                        at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:1230)
                                                                        at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:1120)
                                                                     Caused by: java.lang.SecurityException: Permission Denial: starting Intent { act=android.appwidget.action.APPWIDGET_CONFIGURE cmp=com.samsung.android.email.provider/com.samsung.android.email.widget.EmailWidgetConfig (has extras) } from ProcessRecord{af0a74c 10759:aheschl.screenscortcut/u0a319} (pid=10759, uid=10319) not exported from uid 10033
                                                                        at android.os.Parcel.readException(Parcel.java:1620)
                                                                        at android.os.Parcel.readException(Parcel.java:1573)
                                                                        at android.app.ActivityManagerProxy.startActivity(ActivityManagerNative.java:3131)
                                                                        at android.app.Instrumentation.execStartActivity(Instrumentation.java:1541)
                                                                        at android.app.Activity.startActivityForResult(Activity.java:4284)
                                                                        at android.app.Activity.startActivityForResult(Activity.java:4231)
                                                                        at aheschl.screenscortcut.WidgetEdge.configureWidget(WidgetEdge.java:124)
                                                                        at aheschl.screenscortcut.WidgetEdge.onActivityResult(WidgetEdge.java:94)
                                                                        at android.app.Activity.dispatchActivityResult(Activity.java:7138)
                                                                        at android.app.ActivityThread.deliverResults(ActivityThread.java:4922)
                                                                        at android.app.ActivityThread.handleSendResult(ActivityThread.java:4969) 
                                                                        at android.app.ActivityThread.access$1600(ActivityThread.java:222) 
                                                                        at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1850) 
                                                                        at android.os.Handler.dispatchMessage(Handler.java:102) 
                                                                        at android.os.Looper.loop(Looper.java:158) 
                                                                        at android.app.ActivityThread.main(ActivityThread.java:7230) 
                                                                        at java.lang.reflect.Method.invoke(Native Method) 
                                                                        at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:1230) 
                                                                        at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:1120) 

Here is the method configureWidget which is mentioned in the log

private void configureWidget(Intent data) {
    Bundle extras = data.getExtras();
    int appWidgetId = extras.getInt(AppWidgetManager.EXTRA_APPWIDGET_ID, -1);
    AppWidgetProviderInfo appWidgetInfo = mAppWidgetManager.getAppWidgetInfo(appWidgetId);
    if (appWidgetInfo.configure != null) {

        Intent intent = new Intent(AppWidgetManager.ACTION_APPWIDGET_CONFIGURE);
        intent.setComponent(appWidgetInfo.configure);
        intent.putExtra(AppWidgetManager.EXTRA_APPWIDGET_ID, appWidgetId);
        startActivityForResult(intent, Constants.REQUEST_CREATE_APPWIDGET);

    } else {
        createWidget(data);
    }
}

And here is onActivityResult()

 @Override
protected void onActivityResult(int requestCode, int resultCode, Intent data) {

    super.onActivityResult(requestCode, resultCode, data);

    if (resultCode == RESULT_OK) {
        if (requestCode == Constants.REQUEST_PICK_APPWIDGET) {
            configureWidget(data);
        } else if (requestCode == Constants.REQUEST_CREATE_APPWIDGET) {
            createWidget(data);
        } else if(requestCode == Constants.RESIZE_WIDGETS_CODE){
            //getParams
            int height = data.getIntExtra("height", 100);
            int width = data.getIntExtra("width", 100);
            receivedHeight = height;
            receivedWidth = width;
            waitingForResult = false;
        }
    } else if (resultCode == RESULT_CANCELED && data != null) {
        int appWidgetId = data.getIntExtra(AppWidgetManager.EXTRA_APPWIDGET_ID, -1);
        if (appWidgetId != -1) {
            mAppWidgetHost.deleteAppWidgetId(appWidgetId);
        }
    }
}

Any help is greatly appreciated.

runtime-error widget android java
1 Answers

This is an old question but I think I found the solution.

I was wondering how can activities with exported = "false" tags still be called by some launchers. There is a method startAppWidgetConfigureActivityForResult in AppWidgetHost that these launchers use.

Starts an app widget provider configure activity for result on behalf of the caller. Use this method if the provider is in another profile as you are not allowed to start an activity in another profile. You can optionally provide a request code that is returned in Activity#onActivityResult(int, int, android.content.Intent) and an options bundle to be passed to the started activity. Note that the provided app widget has to be bound for this method to work.

So not only this method can start activity in another profile, but it also ignores the exported = "false" tag. Sounds like a security issue to me.

user_18068600
Related