Skip to content

Use file provider when bluetoothing apks

username-removed-25042 requested to merge pserwylo/fdroidclient:fix-837--file-provider-uri into master

This is required on API >= 24.

The MR is WIP because I am unable to test as I don't have an API 24 device (and emulators don't have Bluetooth). I plan on upgrading my main phone (MotoX 2nd Gen) to this, but in the meantime if anyone else is able to test this and confirm it works it'd be appreciated.

To test:

  • Ensure that trying to send an apk with Bluetooth in 0.103 fails.
  • Build and install this, then send an apk with Bluetooth successfully.

Then, we need to carefully audit this change because it touches pretty security critical parts of the code. That is, the code where apk files are moved to a safe staging area before giving to the PackageManager to be installed. We need to make sure we never allow apks to be written by 3rd parties (if they can read them, it is fine).

Merge request reports