Prevent clickjacking of superuser requests

Enable filterTouchesWhenObscured on the accept request button to prevent
possible clickjacking attacks. This is a measure used in many sensitive
dialogs (app installation, backup & VPN) in AOSP.

Change-Id: I33c18c449c909b97b29b981bffe7f3095adee506

diff --git a/Superuser/res/layout/request.xml b/Superuser/res/layout/request.xml
index bf2a20a..95b1c41 100644 (file)
--- a/Superuser/res/layout/request.xml
+++ b/Superuser/res/layout/request.xml
@@ -119,6 +119,7 @@
             android:layout_height="wrap_content"
             android:layout_weight="1"
             android:enabled="false"
+            android:filterTouchesWhenObscured="true"
             android:text="@string/allow" />
     </LinearLayout>