From fafb1ae8d0addfc7572a62a22d876ba04c3dee22 Mon Sep 17 00:00:00 2001
From: Alexander Bakker <ab@alexbakker.me>
Date: Thu, 15 Nov 2018 22:20:31 +0100
Subject: [PATCH] Set FLAG_SECURE on all dialogs

Fixes #2
---
 .../java/me/impy/aegis/ui/AuthActivity.java   | 12 +++----
 .../impy/aegis/ui/{dialogs => }/Dialogs.java  | 32 +++++++++++++------
 .../me/impy/aegis/ui/EditEntryActivity.java   |  5 ++-
 .../java/me/impy/aegis/ui/MainActivity.java   |  1 -
 .../me/impy/aegis/ui/PreferencesFragment.java | 11 +++----
 .../me/impy/aegis/ui/SlotManagerActivity.java |  5 ++-
 .../aegis/ui/tasks/ProgressDialogTask.java    |  2 ++
 7 files changed, 39 insertions(+), 29 deletions(-)
 rename app/src/main/java/me/impy/aegis/ui/{dialogs => }/Dialogs.java (87%)

diff --git a/app/src/main/java/me/impy/aegis/ui/AuthActivity.java b/app/src/main/java/me/impy/aegis/ui/AuthActivity.java
index 78944f1e..de05bef2 100644
--- a/app/src/main/java/me/impy/aegis/ui/AuthActivity.java
+++ b/app/src/main/java/me/impy/aegis/ui/AuthActivity.java
@@ -113,12 +113,12 @@ public class AuthActivity extends AegisActivity implements FingerprintUiHelper.C
     }
 
     private void showError() {
-        AlertDialog.Builder builder = new AlertDialog.Builder(this);
-        builder.setTitle(getString(R.string.unlock_vault_error));
-        builder.setMessage(getString(R.string.unlock_vault_error_description));
-        builder.setCancelable(false);
-        builder.setPositiveButton(android.R.string.ok, null);
-        builder.create().show();
+        Dialogs.showSecureDialog(new AlertDialog.Builder(this)
+                .setTitle(getString(R.string.unlock_vault_error))
+                .setMessage(getString(R.string.unlock_vault_error_description))
+                .setCancelable(false)
+                .setPositiveButton(android.R.string.ok, null)
+                .create());
     }
 
     private <T extends Slot> void trySlots(Class<T> type, Object obj) {
diff --git a/app/src/main/java/me/impy/aegis/ui/dialogs/Dialogs.java b/app/src/main/java/me/impy/aegis/ui/Dialogs.java
similarity index 87%
rename from app/src/main/java/me/impy/aegis/ui/dialogs/Dialogs.java
rename to app/src/main/java/me/impy/aegis/ui/Dialogs.java
index d6f7c94f..408bf00d 100644
--- a/app/src/main/java/me/impy/aegis/ui/dialogs/Dialogs.java
+++ b/app/src/main/java/me/impy/aegis/ui/Dialogs.java
@@ -1,11 +1,13 @@
-package me.impy.aegis.ui.dialogs;
+package me.impy.aegis.ui;
 
 import android.app.Activity;
+import android.app.Dialog;
 import android.content.DialogInterface;
 import android.hardware.fingerprint.FingerprintManager;
 import android.text.Editable;
 import android.text.TextWatcher;
 import android.view.View;
+import android.view.WindowManager;
 import android.widget.Button;
 import android.widget.EditText;
 import android.widget.TextView;
@@ -36,22 +38,31 @@ public class Dialogs {
 
     }
 
+    public static void secureDialog(Dialog dialog) {
+        dialog.getWindow().setFlags(WindowManager.LayoutParams.FLAG_SECURE, WindowManager.LayoutParams.FLAG_SECURE);
+    }
+
+    public static void showSecureDialog(Dialog dialog) {
+        secureDialog(dialog);
+        dialog.show();
+    }
+
     public static void showDeleteEntryDialog(Activity activity, DialogInterface.OnClickListener onDelete) {
-        new AlertDialog.Builder(activity)
+        showSecureDialog(new AlertDialog.Builder(activity)
                 .setTitle(activity.getString(R.string.delete_entry))
                 .setMessage(activity.getString(R.string.delete_entry_description))
                 .setPositiveButton(android.R.string.yes, onDelete)
                 .setNegativeButton(android.R.string.no, null)
-                .show();
+                .create());
     }
 
     public static void showDiscardDialog(Activity activity, DialogInterface.OnClickListener onSave, DialogInterface.OnClickListener onDiscard) {
-        new AlertDialog.Builder(activity)
+        showSecureDialog(new AlertDialog.Builder(activity)
                 .setTitle(activity.getString(R.string.discard_changes))
                 .setMessage(activity.getString(R.string.discard_changes_description))
                 .setPositiveButton(R.string.save, onSave)
                 .setNegativeButton(R.string.discard, onDiscard)
-                .show();
+                .create());
     }
 
     public static void showSetPasswordDialog(Activity activity, Dialogs.SlotListener listener) {
@@ -59,7 +70,7 @@ public class Dialogs {
         EditText textPassword = view.findViewById(R.id.text_password);
         EditText textPasswordConfirm = view.findViewById(R.id.text_password_confirm);
 
-        AlertDialog alert = new AlertDialog.Builder(activity)
+        AlertDialog dialog = new AlertDialog.Builder(activity)
                 .setTitle(R.string.set_password)
                 .setView(view)
                 .setPositiveButton(android.R.string.ok, null)
@@ -67,8 +78,8 @@ public class Dialogs {
                 .create();
 
         final AtomicReference<Button> buttonOK = new AtomicReference<>();
-        alert.setOnShowListener(dialog -> {
-            Button button = alert.getButton(AlertDialog.BUTTON_POSITIVE);
+        dialog.setOnShowListener(d -> {
+            Button button = dialog.getButton(AlertDialog.BUTTON_POSITIVE);
             button.setEnabled(false);
             buttonOK.set(button);
 
@@ -107,7 +118,7 @@ public class Dialogs {
         textPassword.addTextChangedListener(watcher);
         textPasswordConfirm.addTextChangedListener(watcher);
 
-        alert.show();
+        showSecureDialog(dialog);
     }
 
     public static void showFingerprintDialog(Activity activity, Dialogs.SlotListener listener) {
@@ -135,7 +146,7 @@ public class Dialogs {
                 .setOnDismissListener(d -> {
                     helper.get().stopListening();
                 })
-                .show();
+                .create();
 
         helper.set(new FingerprintUiHelper(manager, imgFingerprint, textFingerprint, new FingerprintUiHelper.Callback() {
             @Override
@@ -151,6 +162,7 @@ public class Dialogs {
         }));
 
         helper.get().startListening(new FingerprintManager.CryptoObject(cipher));
+        showSecureDialog(dialog);
     }
 
     public interface SlotListener {
diff --git a/app/src/main/java/me/impy/aegis/ui/EditEntryActivity.java b/app/src/main/java/me/impy/aegis/ui/EditEntryActivity.java
index 3a185e36..eaaaf41f 100644
--- a/app/src/main/java/me/impy/aegis/ui/EditEntryActivity.java
+++ b/app/src/main/java/me/impy/aegis/ui/EditEntryActivity.java
@@ -52,7 +52,6 @@ import me.impy.aegis.otp.HotpInfo;
 import me.impy.aegis.otp.OtpInfo;
 import me.impy.aegis.otp.OtpInfoException;
 import me.impy.aegis.otp.TotpInfo;
-import me.impy.aegis.ui.dialogs.Dialogs;
 
 public class EditEntryActivity extends AegisActivity {
     private boolean _isNew = false;
@@ -457,11 +456,11 @@ public class EditEntryActivity extends AegisActivity {
     }
 
     private void onSaveError(String msg) {
-        new AlertDialog.Builder(this)
+        Dialogs.showSecureDialog(new AlertDialog.Builder(this)
                 .setTitle(getString(R.string.saving_profile_error))
                 .setMessage(msg)
                 .setPositiveButton(android.R.string.ok, null)
-                .show();
+                .create());
     }
 
     private boolean onSave() {
diff --git a/app/src/main/java/me/impy/aegis/ui/MainActivity.java b/app/src/main/java/me/impy/aegis/ui/MainActivity.java
index e3bb318e..9297be1d 100644
--- a/app/src/main/java/me/impy/aegis/ui/MainActivity.java
+++ b/app/src/main/java/me/impy/aegis/ui/MainActivity.java
@@ -25,7 +25,6 @@ import me.impy.aegis.db.DatabaseManagerException;
 import me.impy.aegis.db.DatabaseEntry;
 import me.impy.aegis.db.DatabaseManager;
 import me.impy.aegis.helpers.PermissionHelper;
-import me.impy.aegis.ui.dialogs.Dialogs;
 import me.impy.aegis.ui.views.EntryListView;
 
 public class MainActivity extends AegisActivity implements EntryListView.Listener {
diff --git a/app/src/main/java/me/impy/aegis/ui/PreferencesFragment.java b/app/src/main/java/me/impy/aegis/ui/PreferencesFragment.java
index 45c19065..9a942197 100644
--- a/app/src/main/java/me/impy/aegis/ui/PreferencesFragment.java
+++ b/app/src/main/java/me/impy/aegis/ui/PreferencesFragment.java
@@ -42,7 +42,6 @@ import me.impy.aegis.helpers.PermissionHelper;
 import me.impy.aegis.importers.AegisImporter;
 import me.impy.aegis.importers.DatabaseImporter;
 import me.impy.aegis.importers.DatabaseImporterException;
-import me.impy.aegis.ui.dialogs.Dialogs;
 import me.impy.aegis.ui.preferences.SwitchPreference;
 import me.impy.aegis.util.ByteInputStream;
 
@@ -148,7 +147,7 @@ public class PreferencesFragment extends PreferenceFragmentCompat {
                 if (!_db.isEncryptionEnabled()) {
                     Dialogs.showSetPasswordDialog(getActivity(), new EnableEncryptionListener());
                 } else {
-                    new AlertDialog.Builder(getActivity())
+                    Dialogs.showSecureDialog(new AlertDialog.Builder(getActivity())
                             .setTitle(getString(R.string.disable_encryption))
                             .setMessage(getString(R.string.disable_encryption_description))
                             .setPositiveButton(android.R.string.yes, new DialogInterface.OnClickListener() {
@@ -162,7 +161,7 @@ public class PreferencesFragment extends PreferenceFragmentCompat {
                                 }
                             })
                             .setNegativeButton(android.R.string.no, null)
-                            .show();
+                            .create());
                 }
                 return false;
             }
@@ -265,7 +264,7 @@ public class PreferencesFragment extends PreferenceFragmentCompat {
         Map<String, Class<? extends DatabaseImporter>> importers = DatabaseImporter.getImporters();
         String[] names = importers.keySet().toArray(new String[importers.size()]);
 
-        new AlertDialog.Builder(getActivity())
+        Dialogs.showSecureDialog(new AlertDialog.Builder(getActivity())
                 .setTitle(getString(R.string.choose_application))
                 .setSingleChoiceItems(names, 0, null)
                 .setPositiveButton(android.R.string.ok, new DialogInterface.OnClickListener() {
@@ -278,7 +277,7 @@ public class PreferencesFragment extends PreferenceFragmentCompat {
                         startActivityForResult(intent, CODE_IMPORT);
                     }
                 })
-                .show();
+                .create());
     }
 
     private void onImportDecryptResult(int resultCode, Intent data) {
@@ -394,7 +393,7 @@ public class PreferencesFragment extends PreferenceFragmentCompat {
         } else {
             builder.setMessage(getString(R.string.export_warning));
         }
-        builder.show();
+        Dialogs.showSecureDialog(builder.create());
     }
 
     private void onSlotManagerResult(int resultCode, Intent data) {
diff --git a/app/src/main/java/me/impy/aegis/ui/SlotManagerActivity.java b/app/src/main/java/me/impy/aegis/ui/SlotManagerActivity.java
index a77b7242..713a39a7 100644
--- a/app/src/main/java/me/impy/aegis/ui/SlotManagerActivity.java
+++ b/app/src/main/java/me/impy/aegis/ui/SlotManagerActivity.java
@@ -23,7 +23,6 @@ import me.impy.aegis.db.slots.Slot;
 import me.impy.aegis.db.slots.SlotList;
 import me.impy.aegis.db.slots.SlotException;
 import me.impy.aegis.helpers.FingerprintHelper;
-import me.impy.aegis.ui.dialogs.Dialogs;
 import me.impy.aegis.ui.views.SlotAdapter;
 
 public class SlotManagerActivity extends AegisActivity implements SlotAdapter.Listener, Dialogs.SlotListener {
@@ -155,7 +154,7 @@ public class SlotManagerActivity extends AegisActivity implements SlotAdapter.Li
             return;
         }
 
-        new AlertDialog.Builder(this)
+        Dialogs.showSecureDialog(new AlertDialog.Builder(this)
                 .setTitle(R.string.remove_slot)
                 .setMessage(R.string.remove_slot_description)
                 .setPositiveButton(android.R.string.yes, (dialog, whichButton) -> {
@@ -165,7 +164,7 @@ public class SlotManagerActivity extends AegisActivity implements SlotAdapter.Li
                     updateFingerprintButton();
                 })
                 .setNegativeButton(android.R.string.no, null)
-                .show();
+                .create());
     }
 
     @Override
diff --git a/app/src/main/java/me/impy/aegis/ui/tasks/ProgressDialogTask.java b/app/src/main/java/me/impy/aegis/ui/tasks/ProgressDialogTask.java
index b9d8f771..b203a16e 100644
--- a/app/src/main/java/me/impy/aegis/ui/tasks/ProgressDialogTask.java
+++ b/app/src/main/java/me/impy/aegis/ui/tasks/ProgressDialogTask.java
@@ -5,6 +5,7 @@ import android.content.Context;
 import android.os.AsyncTask;
 import android.os.Process;
 import androidx.annotation.CallSuper;
+import me.impy.aegis.ui.Dialogs;
 
 public abstract class ProgressDialogTask<Params, Result> extends AsyncTask<Params, Void, Result> {
     private ProgressDialog _dialog;
@@ -13,6 +14,7 @@ public abstract class ProgressDialogTask<Params, Result> extends AsyncTask<Param
         _dialog = new ProgressDialog(context);
         _dialog.setCancelable(false);
         _dialog.setMessage(message);
+        Dialogs.secureDialog(_dialog);
     }
 
     @CallSuper