@@ -58,6 +58,7 @@ public ParcelFileDescriptor openFile(Uri uri, String mode)
5858 String LOG_TAG = CLASS_NAME + " - openFile" ;
5959
6060// Log.v(LOG_TAG,"Called with uri: '" + uri + "'." + uri.getLastPathSegment());
61+ // URI always look like content://org.paladyn.mediclog.LocalFileProvider/mediclog.txt
6162
6263 // Check incoming Uri against the matcher
6364 switch (uriMatcher .match (uri )) {
@@ -76,12 +77,28 @@ public ParcelFileDescriptor openFile(Uri uri, String mode)
7677 + uri .getLastPathSegment ();
7778 // Protect against a possible Path Traversal vulnerablity by checking that the Cannonical
7879 // path starts with the right string
79- // Log.v(LOG_TAG, "fileLocation: '" + fileLocation + "'.");
80+ // Log.v(LOG_TAG, "fileLocation: '" + fileLocation + "'.");
8081 File f ;
8182 try {
8283 f = new File (fileLocation );
83- if (!f .getCanonicalPath ().startsWith (getContext ().getFilesDir () + File .separator )) {
84- Log .v (LOG_TAG , "fileLocation: " + fileLocation + "is invalid" );
84+ String oldvalid = getContext ().getFilesDir () + File .separator ;
85+ String newvalid = "/data/data/" + getContext ().getPackageName () + "/files/" ;
86+ Boolean ob = f .getCanonicalPath ().startsWith (oldvalid );
87+ Boolean nb = f .getCanonicalPath ().startsWith (newvalid );
88+ // Log.v(LOG_TAG, "oldvalid is " + oldvalid + "newvalid is " + newvalid);
89+ // if (ob) {
90+ // Log.v(LOG_TAG, "ob is true");
91+ // }
92+ // if (nb) {
93+ // Log.v(LOG_TAG, "nb is true");
94+ // }
95+ if (!( ob || nb ))
96+ {
97+ // The second case is a horrible kludge for API 28, where the path starts /data/data, as opposed to /data/user/0/
98+
99+ Log .v (LOG_TAG , "fileLocation: " + fileLocation + " is invalid" );
100+ Log .v (LOG_TAG , "f.getCannonicalPath is " + f .getCanonicalPath ());
101+ Log .v (LOG_TAG , "kludged path is /data/data/" + getContext ().getPackageName () + "/files/" );
85102 throw new IllegalArgumentException ();
86103 }
87104 } catch (IOException ex ) {
0 commit comments