From 482415d37e586d1c8428d64df04bddd86b791102 Mon Sep 17 00:00:00 2001
From: Antony Sargent <asargent@google.com>
Date: Wed, 31 Jul 2019 12:53:39 -0700
Subject: [PATCH] Protect entry points to add an eSIM when admin restricted

If the DISALLOW_CONFIG_MOBILE_NETWORKS admin policy is set, we were
accidentally still allowing access to the flow where you add an eSIM
subscription via the "plus" button on the Network & internet page. While
fixing this, I also noticed that the mobile networks list page (which
only becomes available if you have multiple subscriptions) has a link at
the bottom to start the flow as well, and that wasn't being protected.

The fix for the plus button on the Network & internet page was just to
make sure not to call setEnabled(true) if the preference was already
disabled by admin policy, since that has the effect of overriding the
admin-disabling.

The fix for the mobile networks list page just needed to add the
relevant tags in the layout XML, and then we get it for free.

Fixes: 137627845
Test: make RunSettingsRoboTests
Change-Id: I896ac248f50aaeecc157791938a0a0a98265aa07
---
 res/xml/mobile_network_list.xml                          | 6 ++++--
 .../settings/network/MobileNetworkSummaryController.java | 2 +-
 .../network/MobileNetworkSummaryControllerTest.java      | 9 +++++++++
 3 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/res/xml/mobile_network_list.xml b/res/xml/mobile_network_list.xml
index 13f9a597132..01ddb28df53 100644
--- a/res/xml/mobile_network_list.xml
+++ b/res/xml/mobile_network_list.xml
@@ -20,9 +20,11 @@
     android:key="mobile_network_list_screen"
     android:title="@string/network_settings_title">
 
-    <Preference
+    <com.android.settingslib.RestrictedPreference
         android:key="add_more"
         settings:isPreferenceVisible="false"
+        settings:userRestriction="no_config_mobile_networks"
+        settings:useAdminDisabledSummary="true"
         android:title="@string/mobile_network_list_add_more"
         android:icon="@drawable/ic_menu_add_activated_tint"
         android:order="100" >
@@ -30,6 +32,6 @@
             <extra android:name="android.telephony.euicc.extra.FORCE_PROVISION"
                    android:value="true"/>
         </intent>
-    </Preference>
+    </com.android.settingslib.RestrictedPreference>
 
 </PreferenceScreen>
diff --git a/src/com/android/settings/network/MobileNetworkSummaryController.java b/src/com/android/settings/network/MobileNetworkSummaryController.java
index 0f76f24de56..bd3e2efbb6d 100644
--- a/src/com/android/settings/network/MobileNetworkSummaryController.java
+++ b/src/com/android/settings/network/MobileNetworkSummaryController.java
@@ -130,7 +130,7 @@ public class MobileNetworkSummaryController extends AbstractPreferenceController
     }
 
     private void update() {
-        if (mPreference == null) {
+        if (mPreference == null || mPreference.isDisabledByAdmin()) {
             return;
         }
         refreshSummary(mPreference);
diff --git a/tests/robotests/src/com/android/settings/network/MobileNetworkSummaryControllerTest.java b/tests/robotests/src/com/android/settings/network/MobileNetworkSummaryControllerTest.java
index 99c9134c77d..e24b0f22a5b 100644
--- a/tests/robotests/src/com/android/settings/network/MobileNetworkSummaryControllerTest.java
+++ b/tests/robotests/src/com/android/settings/network/MobileNetworkSummaryControllerTest.java
@@ -42,6 +42,7 @@ import android.text.TextUtils;
 
 import com.android.settings.network.telephony.MobileNetworkActivity;
 import com.android.settings.widget.AddPreference;
+import com.android.settingslib.RestrictedLockUtils;
 
 import org.junit.After;
 import org.junit.Before;
@@ -373,4 +374,12 @@ public class MobileNetworkSummaryControllerTest {
         verify(mPreference, atLeastOnce()).setAddWidgetEnabled(captor.capture());
         assertThat(captor.getValue()).isTrue();
     }
+
+    @Test
+    public void onResume_disabledByAdmin_prefStaysDisabled() {
+        mPreference.setDisabledByAdmin(new RestrictedLockUtils.EnforcedAdmin());
+        mController.displayPreference(mPreferenceScreen);
+        mController.onResume();
+        verify(mPreference, never()).setEnabled(eq(true));
+    }
 }