Skip to content

Always cache apks to internal storage / Make symlinking safer

username-removed-25042 requested to merge pserwylo/fdroidclient:feature/cache-to-internal into master

Apks need to be cached to internal storage, otherwise malicious apps with "Write external storage" permissions may be able to overwrite the .apk file before the package manager installs it.

As a pure coincidence, this also fixes issue #125 (closed), in a very similar way to MR #46 (closed). The difference is that this is more of a security oriented fix, and so the code to set file permissions (on older devices) is a little more robust.

I've tested this on my Nexus 4/AOSP 5.0 and an LG optimus 1/Random-crapware-from-ebay-2.3.3 with no problems installing apps (from a fresh install).

Merge request reports