Fix up receiver declaration.

The intent this receiver listens to is used by the BT MAP implementation
to send out SMS it queued. As the manifest and the
SmsReceiverService.java were in disagreement about the action name, this
didn't work.
Also secure the receiver in the process, it can be used to send out SMS
without having the SEND_SMS permission otherwise.

Change-Id: Ia8d181731baea586865ce3f18fe0864636c2b6f4

2 files changed, 14 insertions, 3 deletions

diff --git a/AndroidManifest.xml b/AndroidManifest.xml
index 62d65ae..4ed4a34 100644
--- a/AndroidManifest.xml
+++ b/AndroidManifest.xml
@@ -227,6 +227,14 @@
             </intent-filter>
         </receiver>
 
+        <!-- Require sender permissions as it can be used to indirectly send SMS -->
+        <receiver android:name=".transaction.PrivilegedSmsReceiver"
+            android:permission="android.permission.SEND_SMS">
+            <intent-filter>
+                <action android:name="com.android.mms.transaction.SEND_MESSAGE" />
+            </intent-filter>
+        </receiver>
+
         <!-- Catch-all receiver for broadcasts that don't have associated security -->
         <receiver android:name=".transaction.SmsReceiver">
             <intent-filter>
@@ -237,9 +245,6 @@
                 <!-- TODO Do a better data match here. -->
                 <data android:scheme="content" />
             </intent-filter>
-            <intent-filter>
-                <action android:name="android.intent.action.SEND_MESSAGE" />
-            </intent-filter>
         </receiver>
 
         <receiver android:name=".transaction.MessageStatusReceiver">
diff --git a/src/com/android/mms/transaction/SmsReceiver.java b/src/com/android/mms/transaction/SmsReceiver.java
index 22eb4e6..8e52ea7 100644
--- a/src/com/android/mms/transaction/SmsReceiver.java
+++ b/src/com/android/mms/transaction/SmsReceiver.java
@@ -53,6 +53,12 @@ public class SmsReceiver extends BroadcastReceiver {
             return;
         }
 
+        // same thing applies to the send-queued-messages request: it can be used to send
+        // SMS without having the SEND_SMS permission
+        if (!privileged && intent.getAction().equals(SmsReceiverService.ACTION_SEND_MESSAGE)) {
+            return;
+        }
+
         intent.setClass(context, SmsReceiverService.class);
         intent.putExtra("result", getResultCode());
         beginStartingService(context, intent);