tree d0f110f167516f146bb4b2bdc2815a30528c3b1c
parent e2322bdd7865552aa31f93bbf4e60d4d9a7d0973
author Amith Yamasani <yamasani@google.com> 1368043021 -0700
committer Amith Yamasani <yamasani@google.com> 1368043021 -0700

Don't allow non-authorized apps to access auth tokens

For restricted profiles, if an app tries to guess an account name and
requests an auth token, even though the framework is going to prompt
for permission, it could be authorized by someone who can't read.

If the app is not opting in to see accounts, don't let it get auth tokens
by verifying first that it's in the list of known accounts.

Bug: 8736380
Change-Id: I6caf88cfe14aa1023d55bcb28ad80ccd89eeb79b