{"action":"created","issue":{"url":"https://api.github.com/repos/owncloud/android/issues/1107","labels_url":"https://api.github.com/repos/owncloud/android/issues/1107/labels{/name}","comments_url":"https://api.github.com/repos/owncloud/android/issues/1107/comments","events_url":"https://api.github.com/repos/owncloud/android/issues/1107/events","html_url":"https://github.com/owncloud/android/pull/1107","id":102609122,"number":1107,"title":"Add `android:filterTouchesWhenObscured`","user":{"login":"LukasReschke","id":878997,"avatar_url":"https://avatars.githubusercontent.com/u/878997?v=3","gravatar_id":"","url":"https://api.github.com/users/LukasReschke","html_url":"https://github.com/LukasReschke","followers_url":"https://api.github.com/users/LukasReschke/followers","following_url":"https://api.github.com/users/LukasReschke/following{/other_user}","gists_url":"https://api.github.com/users/LukasReschke/gists{/gist_id}","starred_url":"https://api.github.com/users/LukasReschke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/LukasReschke/subscriptions","organizations_url":"https://api.github.com/users/LukasReschke/orgs","repos_url":"https://api.github.com/users/LukasReschke/repos","events_url":"https://api.github.com/users/LukasReschke/events{/privacy}","received_events_url":"https://api.github.com/users/LukasReschke/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/owncloud/android/labels/2%20-%20Working","name":"2 - Working","color":"CCCCCC"},{"url":"https://api.github.com/repos/owncloud/android/labels/ReadyToTest","name":"ReadyToTest","color":"5319e7"},{"url":"https://api.github.com/repos/owncloud/android/labels/security","name":"security","color":"009800"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/owncloud/android/milestones/15","html_url":"https://github.com/owncloud/android/milestones/1.8.1-next","labels_url":"https://api.github.com/repos/owncloud/android/milestones/15/labels","id":1220210,"number":15,"title":"1.8.1-next","description":"","creator":{"login":"cmonteroluque","id":879976,"avatar_url":"https://avatars.githubusercontent.com/u/879976?v=3","gravatar_id":"","url":"https://api.github.com/users/cmonteroluque","html_url":"https://github.com/cmonteroluque","followers_url":"https://api.github.com/users/cmonteroluque/followers","following_url":"https://api.github.com/users/cmonteroluque/following{/other_user}","gists_url":"https://api.github.com/users/cmonteroluque/gists{/gist_id}","starred_url":"https://api.github.com/users/cmonteroluque/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cmonteroluque/subscriptions","organizations_url":"https://api.github.com/users/cmonteroluque/orgs","repos_url":"https://api.github.com/users/cmonteroluque/repos","events_url":"https://api.github.com/users/cmonteroluque/events{/privacy}","received_events_url":"https://api.github.com/users/cmonteroluque/received_events","type":"User","site_admin":false},"open_issues":9,"closed_issues":0,"state":"open","created_at":"2015-07-22T13:28:03Z","updated_at":"2015-09-15T13:33:11Z","due_on":null,"closed_at":null},"comments":11,"created_at":"2015-08-23T11:01:25Z","updated_at":"2015-09-15T13:33:11Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/owncloud/android/pulls/1107","html_url":"https://github.com/owncloud/android/pull/1107","diff_url":"https://github.com/owncloud/android/pull/1107.diff","patch_url":"https://github.com/owncloud/android/pull/1107.patch"},"body":"To prevent tapjacking like attacks we should explicitly enable this attribute. Fore more details see https://blog.lookout.com/look-10-007-tapjacking/ and https://developer.android.com/intl/en/reference/android/view/View.html#Security\r\n\r\nNote that this does not affect all Android devices as for example Samsung started with Ice Cream Sandwich to mitigate this issue on OS level. This PR also does not offer a complete protection but already a pretty suitable one. (for example the ActionBar navigation in fragments still can be invoked, but account settings are at least protected now)\r\n\r\nTo test this I can recommend the https://github.com/mwrlabs/tapjacking-poc application.\r\n\r\nFixes https://github.com/owncloud/security-tracker/issues/165\r\n\r\n<!---\r\n@huboard:{\"order\":0.375,\"milestone_order\":1107,\"custom_state\":\"\"}\n-->\r\n"},"comment":{"url":"https://api.github.com/repos/owncloud/android/issues/comments/140394723","html_url":"https://github.com/owncloud/android/pull/1107#issuecomment-140394723","issue_url":"https://api.github.com/repos/owncloud/android/issues/1107","id":140394723,"user":{"login":"davivel","id":2225614,"avatar_url":"https://avatars.githubusercontent.com/u/2225614?v=3","gravatar_id":"","url":"https://api.github.com/users/davivel","html_url":"https://github.com/davivel","followers_url":"https://api.github.com/users/davivel/followers","following_url":"https://api.github.com/users/davivel/following{/other_user}","gists_url":"https://api.github.com/users/davivel/gists{/gist_id}","starred_url":"https://api.github.com/users/davivel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davivel/subscriptions","organizations_url":"https://api.github.com/users/davivel/orgs","repos_url":"https://api.github.com/users/davivel/repos","events_url":"https://api.github.com/users/davivel/events{/privacy}","received_events_url":"https://api.github.com/users/davivel/received_events","type":"User","site_admin":false},"created_at":"2015-09-15T13:33:11Z","updated_at":"2015-09-15T13:33:11Z","body":"@LukasReschke , the problem I talked about is not related with the PR itself and needs to be fixed anyway.\r\n\r\nI understand this is not critical, but can keep it around 'til the tests are fixed."}}