Secure Activities - no permission - android

The following is found on https://www.oreilly.com/library/view/application-security-for/9781449322250/ch04.html
with the comment "To require a certain permission to start an Activity, you need to add the permission attribute to the specific Activity’s entry in AndroidManifest.xml."
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
package="com.example.testapps.test1">
...
<activity android:name=".Activity1"
android:permission="com.example.testapps.test1.permission.START_ACTIVITY1">
<intent-filter>
...
</intent-filter>
</activity>
...
</manifest>
What should I do if I want to prevent to start the activity? Not setting the permission seems to let the activity start without any permission...

If you don't want the activity to be launched then use the following to mark it as disabled.
android:enabled="false"

What should I do if I want to prevent to start the activity?
Remove the <intent-filter>. Your <intent-filter> is saying "I want other apps to start this activity". Activities without an <intent-filter> can still be started by your app, used in PendingIntent objects, etc.

Related

Defining your own permissions in android

I am trying make my own permission for android application.
For this my android manifest file looks like this.
<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
package="com.example.hp.happybirthday" >
<permission
android:name="com.example.hp.happybirthday.PERM"
android:description="#string/pdesc"
android:label="#string/CAREFUL"
/>
<application
android:allowBackup="true"
android:icon="#mipmap/ic_launcher"
android:label="#string/app_name"
android:theme="#style/AppTheme"
android:permission="com.example.hp.happybirthday.PERM">
<activity
android:name=".MainActivity"
android:label="#string/app_name" >
<intent-filter>
<action android:name="android.intent.action.MAIN" />
<category android:name="android.intent.category.LAUNCHER" />
</intent-filter>
</activity>
</application>
</manifest>
The problem that I am facing is that I want to have my own permission associated with this application and hence i have added the following line as shown above under the application tag, so that only those activities have access to this app which possess my defined permission.
android:permission="com.example.hp.happybirthday.PERM"
But the problem is that when I try to run my app, the app whose manifest file I have declared, it shows the error app is not installed.
But when I remove the above mentioned line, it works, but then any activity will have access to this app which I do not want.
when I try to run my app, the app whose manifest file I have declared, it shows the error app is not installed
That is because the home screen is an app, and the home screen does not hold your custom permission. Hence, the home screen cannot start your launcher activity.
then any activity will have access to this app which I do not want
First, custom permissions do not work all that well.
Second, permissions are usually applied at a finer granularity than "this app". You only secure those components that need the security, and you leave public other components, like the launcher activity.
It looks like you've defined the permission, and set it to be required... but you haven't actually granted it to your own app. Add a uses-permission tag

Don't show my app in recent app

I want Don't show my app in recent app when user run or close my app in hdevice
my purpose is:
user Disabling to run my app
i am sorry for bad speak .
Try this..
For your every activity android:excludeFromRecents="true"
<activity
android:name=".Activity"
android:excludeFromRecents="true" >
<intent-filter>
<action android:name="android.intent.action.MAIN" />
<category android:name="android.intent.category.LAUNCHER" />
</intent-filter>
</activity>
For more information refer this doc
From Android Doc
Read this.
android:excludeFromRecents
Whether or not the task initiated by this
activity should be excluded from the list of recently used
applications ("recent apps"). That is, when this activity is the root
activity of a new task, this attribute determines whether the task
should not appear in the list of recent apps. Set "true" if the task
should be excluded from the list; set "false" if it should be
included. The default value is "false".
add android:excludeFromRecents="true" in your xml (AndroidManifest.xml) for the activity tag
excludeFromRecents is what you are looking for.
Just add this to your Activity tag in the AndroidManifest.xml:
android:excludeFromRecents="true"

Change Android App starting activity

I'm trying to change the start up activity.
I created an activity when the app loads but I want to add a screen before that, I'm not sure where to change the Android manifest to load a certain layout/activity when the app starts.
The startup activity [Launcher Activity] is declared in the projects' AndroidManifest.xml file
Look for that activity tag in the manifest which looks like this
<activity android:name=".Main"
android:label="#string/app_name">
<intent-filter>
<action android:name="android.intent.action.MAIN" />
<category android:name="android.intent.category.LAUNCHER" />
</intent-filter>
</activity>
Look at the attribute android:name. Main is the class which is launched when the app starts. Currently your calendar activity name should be there. Change that to the .classpath of your activity that you want to launch.
That should do it. You may also want to do the hello world application in the tutorials and go through the docs a little to see how Android Applications work.
From here
Just create another activity and set it as Launcher Activity and after a timer (if that's your achieve) just call the other activity!

Launching given activities directly

I'd like to create run configurations within Eclipse to launch a given Android activity directly so I don't have to run through my entire application to get to it. In my manifest, I've declared the activity like so:
<activity
android:name=".AlternativeActivity"
android:label="#string/title_alternative_activity"
android:exported="true">
<meta-data
android:name="android.support.PARENT_ACTIVITY"
android:value="com.mysite.AlternativeActivity" />
<intent-filter>
<action android:name="android.intent.action.MAIN" />
</intent-filter>
</activity
However, in Eclipse, I'm seeing the following warning:
Exported activity does not require permission.
How do I resolve this warning?
Exported activities (activities which either set exported=true or
contain an intent-filter and do not specify exported=false) should
define a permission that an entity must have in order to launch the
activity or bind to it. Without this, any application can use this
activity.
Protip: Place your cursor on the warning, press CTRL + 1 and select "Explain Issue".

Exported Activity Permission for AppWidget Configuration Activity

I'm getting this warning for my AppWidget's configuration activity in the manifest file after I added the android:exported="true" tag. This is what it looks like...
<activity android:name=".widgets.WidgetConfigurationActivity"
android:theme="#android:style/Theme.Translucent"
android:exported="true" >
<intent-filter>
<action android:name="android.appwidget.action.APPWIDGET_CONFIGURE" />
</intent-filter>
</activity>
The warning I'm getting is "Exported activity does not require permission". From my understanding, setting the exported tag to true means that another application not related to my app can access it (which would make sense since the home screen launcher apps needs to launch my AppWidget's configuration activity). Does anyone know what kind of permission I need to add here to make this not give an error?
From my understanding, setting the exported tag to true means that another application not related to my app can access it
Correct. Note that it is superfluous here: having an <intent-filter> makes the activity be exported by default.
Does anyone know what kind of permission I need to add here to make this not give an error?
AFAIK, you cannot guarantee that the home screen has any particular permission.
IMHO, this is an erroneous warning, one that I filed a related issue for that should be fixed someday.
You can change the attribute android:exported="true" to android:exported="false".
That should fix the problem for you.

Categories

Resources