Skip to content

Protection of intentURL attack using interactive dialog confirmation#315

Merged
jmattheis merged 2 commits into
gotify:masterfrom
cyb3rko:intent-url-protection
Oct 7, 2023
Merged

Protection of intentURL attack using interactive dialog confirmation#315
jmattheis merged 2 commits into
gotify:masterfrom
cyb3rko:intent-url-protection

Conversation

@cyb3rko

@cyb3rko cyb3rko commented Oct 1, 2023

Copy link
Copy Markdown
Contributor

As discussed before here's the implementation using a dialog activity.
What's missing now is getting the permission. As it's rather optional to use this feature I wonder how we want to inform the user about the missing permission.

Same as with the other permissions right at the launch (InitializationActivity) or via the settings?

Closes #227

@jmattheis jmattheis left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Works like a charm (:

Comment thread app/src/main/kotlin/com/github/gotify/messages/IntentUrlDialogActivity.kt Outdated
Comment thread app/src/main/res/values/strings.xml Outdated
Comment thread app/src/main/res/values/styles.xml
@cyb3rko
cyb3rko force-pushed the intent-url-protection branch from d611435 to 567fcb4 Compare October 2, 2023 19:20
Comment thread app/src/main/AndroidManifest.xml Outdated
Comment thread app/src/main/res/values/styles.xml
@cyb3rko
cyb3rko force-pushed the intent-url-protection branch from fff5888 to b85ce16 Compare October 3, 2023 09:44
@cyb3rko
cyb3rko marked this pull request as ready for review October 3, 2023 14:36
@cyb3rko
cyb3rko force-pushed the intent-url-protection branch from 9fbb475 to 41bd73f Compare October 4, 2023 19:25
Comment thread app/src/main/kotlin/com/github/gotify/settings/SettingsActivity.kt Outdated
Comment thread app/src/main/kotlin/com/github/gotify/settings/SettingsActivity.kt Outdated
@cyb3rko
cyb3rko force-pushed the intent-url-protection branch from 41bd73f to 45b41b5 Compare October 5, 2023 18:06

@jmattheis jmattheis left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

@jmattheis
jmattheis merged commit 361c480 into gotify:master Oct 7, 2023
@cyb3rko
cyb3rko deleted the intent-url-protection branch October 7, 2023 10:01
jmattheis added a commit to gotify/website that referenced this pull request Nov 18, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

Non-Interactive Execution of android::action:onReceive:intentUrl Opens Large Attack Surface and Should be Optional

2 participants