From f7a0f125dbfb2afd816eb0057050c964a482a986 Mon Sep 17 00:00:00 2001
From: Chiachang Wang <chiachangwang@google.com>
Date: Wed, 12 Feb 2020 13:44:50 +0800
Subject: [PATCH] Add permission check for CaptivePortal#reevaluateNetwork

CaptivePortal#reevaluateNetwork is added as a system API which
requires a proper permission check.

Bug: 148379628
Test: Manually check with captive portal
Test: atest FrameworksNetTests
Test: make test-api-stubs-docs-update-current-api \
      system-api-stubs-docs-update-current-api

Change-Id: I3f974339d5bd53a6f6ecb0842c02a8264dc3a5f9
Merged-In: I559d42089aeb09801d14c251c5165fca793c3cb3
---
 core/java/android/net/CaptivePortal.java                       | 2 ++
 services/core/java/com/android/server/ConnectivityService.java | 1 +
 2 files changed, 3 insertions(+)

diff --git a/core/java/android/net/CaptivePortal.java b/core/java/android/net/CaptivePortal.java
index fb35b4bde3..448fe5a051 100644
--- a/core/java/android/net/CaptivePortal.java
+++ b/core/java/android/net/CaptivePortal.java
@@ -16,6 +16,7 @@
 package android.net;
 
 import android.annotation.NonNull;
+import android.annotation.RequiresPermission;
 import android.annotation.SystemApi;
 import android.annotation.TestApi;
 import android.os.IBinder;
@@ -153,6 +154,7 @@ public class CaptivePortal implements Parcelable {
      */
     @SystemApi
     @TestApi
+    @RequiresPermission(android.Manifest.permission.NETWORK_STACK)
     public void reevaluateNetwork() {
         try {
             ICaptivePortal.Stub.asInterface(mBinder).appRequest(APP_REQUEST_REEVALUATION_REQUIRED);
diff --git a/services/core/java/com/android/server/ConnectivityService.java b/services/core/java/com/android/server/ConnectivityService.java
index b3b1722664..3433ef0a65 100644
--- a/services/core/java/com/android/server/ConnectivityService.java
+++ b/services/core/java/com/android/server/ConnectivityService.java
@@ -3744,6 +3744,7 @@ public class ConnectivityService extends IConnectivityManager.Stub
             if (nm == null) return;
 
             if (request == CaptivePortal.APP_REQUEST_REEVALUATION_REQUIRED) {
+                checkNetworkStackPermission();
                 nm.forceReevaluation(Binder.getCallingUid());
             }
         }