From 783870c2050c735432758a6c047af2c70a9f8f65 Mon Sep 17 00:00:00 2001
From: Andrew Scull <ascull@google.com>
Date: Wed, 15 Mar 2017 12:42:18 +0000
Subject: [PATCH] Disallow fingerprint based on user unlock state.

Previously, the KeyStore lock state was used but this doesn't hold any
real value and may be removed in future. The user unlock state is the
source of truth we are looking for.

Test: Enroll finger, turn off work, lock and unlock device, turn on
work, asked for pin but can no longer user fingerprint.
Fixes: 34858001

Change-Id: I228952f4f7fd24916d294b5b523c6d3609520506
---
 .../settings/ConfirmDeviceCredentialBaseFragment.java | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/src/com/android/settings/ConfirmDeviceCredentialBaseFragment.java b/src/com/android/settings/ConfirmDeviceCredentialBaseFragment.java
index 40972aca7cb..a5aa5b4e901 100644
--- a/src/com/android/settings/ConfirmDeviceCredentialBaseFragment.java
+++ b/src/com/android/settings/ConfirmDeviceCredentialBaseFragment.java
@@ -76,6 +76,7 @@ public abstract class ConfirmDeviceCredentialBaseFragment extends OptionsMenuFra
     protected ImageView mFingerprintIcon;
     protected int mEffectiveUserId;
     protected int mUserId;
+    protected UserManager mUserManager;
     protected LockPatternUtils mLockPatternUtils;
     protected TextView mErrorTextView;
     protected final Handler mHandler = new Handler();
@@ -90,8 +91,8 @@ public abstract class ConfirmDeviceCredentialBaseFragment extends OptionsMenuFra
         // Only take this argument into account if it belongs to the current profile.
         Intent intent = getActivity().getIntent();
         mUserId = Utils.getUserIdFromBundle(getActivity(), intent.getExtras());
-        final UserManager userManager = UserManager.get(getActivity());
-        mEffectiveUserId = userManager.getCredentialOwnerProfile(mUserId);
+        mUserManager = UserManager.get(getActivity());
+        mEffectiveUserId = mUserManager.getCredentialOwnerProfile(mUserId);
         mLockPatternUtils = new LockPatternUtils(getActivity());
     }
 
@@ -117,7 +118,7 @@ public abstract class ConfirmDeviceCredentialBaseFragment extends OptionsMenuFra
                 Utils.getUserIdFromBundle(
                         getActivity(),
                         getActivity().getIntent().getExtras()));
-        if (UserManager.get(getActivity()).isManagedProfile(credentialOwnerUserId)) {
+        if (mUserManager.isManagedProfile(credentialOwnerUserId)) {
             setWorkChallengeBackground(view, credentialOwnerUserId);
         }
     }
@@ -135,7 +136,7 @@ public abstract class ConfirmDeviceCredentialBaseFragment extends OptionsMenuFra
     // fingerprint is disabled due to device restart.
     private boolean isFingerprintDisallowedByStrongAuth() {
         return !(mLockPatternUtils.isFingerprintAllowedForUser(mEffectiveUserId)
-                && KeyStore.getInstance().state(mUserId) == KeyStore.State.UNLOCKED);
+                && mUserManager.isUserUnlocked(mUserId));
     }
 
     @Override
@@ -262,7 +263,7 @@ public abstract class ConfirmDeviceCredentialBaseFragment extends OptionsMenuFra
     }
 
     protected boolean isProfileChallenge() {
-        return UserManager.get(getContext()).isManagedProfile(mEffectiveUserId);
+        return mUserManager.isManagedProfile(mEffectiveUserId);
     }
 
     protected void reportSuccessfullAttempt() {