commit 429cf07ee6feb08a6217a95f8400e81fbbe2c5f7
author Robert Greenwalt <rgreenwalt@google.com> Tue May 21 17:04:09 2013 -0700
committer Robert Greenwalt <rgreenwalt@google.com> Wed May 22 09:14:41 2013 -0700
tree 0a84b252d55f8ed6799e320bc3af04a34bbd3046
parent 4cf7d104bce51c3fed721f4ea9af318d9bf7ecf9

Allow MMS queries without permission.

If you ask for results other than type, mmsc, mmsproxy or mmsport
you'll need permissions to do so.

bug:7632229
Change-Id: I02d8ce8427dd21d9fd1fe17d225de16a88d2e617

src/com/android/providers/telephony/TelephonyProvider.java

diff --git a/src/com/android/providers/telephony/TelephonyProvider.java b/src/com/android/providers/telephony/TelephonyProvider.java
index b7cc7a9..f68ac51 100644
--- a/src/com/android/providers/telephony/TelephonyProvider.java
+++ b/src/com/android/providers/telephony/TelephonyProvider.java
@@ -458,10 +458,8 @@
     @Override
     public Cursor query(Uri url, String[] projectionIn, String selection,
             String[] selectionArgs, String sort) {
-
-        checkPermission();
-
         SQLiteQueryBuilder qb = new SQLiteQueryBuilder();
+        qb.setStrict(true); // a little protection from injection attacks
         qb.setTables("carriers");
 
         int match = s_urlMatcher.match(url);
@@ -495,6 +493,24 @@
             }
         }
 
+        if (projectionIn != null) {
+            for (String column : projectionIn) {
+                if (Telephony.Carriers.TYPE.equals(column) ||
+                        Telephony.Carriers.MMSC.equals(column) ||
+                        Telephony.Carriers.MMSPROXY.equals(column) ||
+                        Telephony.Carriers.MMSPORT.equals(column) ||
+                        Telephony.Carriers.APN.equals(column)) {
+                    // noop
+                } else {
+                    checkPermission();
+                    break;
+                }
+            }
+        } else {
+            // null returns all columns, so need permission check
+            checkPermission();
+        }
+
         SQLiteDatabase db = mOpenHelper.getReadableDatabase();
         Cursor ret = null;
         try {