Make SESSION_UPDATED broadcast explicit.

This restricts the broadcast message only to the original installer of
the package. At the same time, this allows the broadcast receiver to
declare the receiver in the android manifest for this message, which
would otherwise be ignored if the broadcast message was implicit.

Change-Id: Ic1d8851ba8f3cee83ad715e488b60261a07af8d8
Fix: 124897340
Test: atest CtsStagedInstallHostTestCases (modified in separate CL)

diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java
index 1a33b16..81448b7 100644 (file)
--- a/services/core/java/com/android/server/pm/PackageManagerService.java
+++ b/services/core/java/com/android/server/pm/PackageManagerService.java
@@ -20027,8 +20027,12 @@ public class PackageManagerService extends IPackageManager.Stub
      */
     public void sendSessionUpdatedBroadcast(PackageInstaller.SessionInfo sessionInfo,
             int userId) {
+        if (TextUtils.isEmpty(sessionInfo.installerPackageName)) {
+            return;
+        }
         Intent sessionUpdatedIntent = new Intent(PackageInstaller.ACTION_SESSION_UPDATED)
-                .putExtra(PackageInstaller.EXTRA_SESSION, sessionInfo);
+                .putExtra(PackageInstaller.EXTRA_SESSION, sessionInfo)
+                .setPackage(sessionInfo.installerPackageName);
         mContext.sendBroadcastAsUser(sessionUpdatedIntent, UserHandle.of(userId));
     }