Prevent clickjacking of superuser requests

Enable filterTouchesWhenObscured on the accept request button to prevent possible clickjacking attacks. This is a measure used in many sensitive dialogs (app installation, backup & VPN) in AOSP.
koush · Jul 18, 2014 · c0fdfc2 · c0fdfc2 · tonysanjaya · Mar 29, 2015
1 parent 6972532
commit c0fdfc2
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/Superuser/res/layout/request.xml b/Superuser/res/layout/request.xml
@@ -119,6 +119,7 @@
             android:layout_height="wrap_content"
             android:layout_weight="1"
             android:enabled="false"
+            android:filterTouchesWhenObscured="true"
             android:text="@string/allow" />
     </LinearLayout>