Chapter 29 Broadcast Intents
Limiting broadcasts to your app using private permissions
One issue with a broadcast like this is that anyone on the system can listen to it or trigger your
receivers. You are usually not going to want either of those things to happen.
You can preclude these unauthorized intrusions into your personal business in a couple of ways.
One way is to declare in your manifest that the receiver is internal to your app by adding an
android:exported="false" attribute to your receiver tag. This will prevent it from being visible to
other applications on the system.
Another way is to create your own permission by adding a permission tag to your
AndroidManifest.xml. This is the approach you will take for PhotoGallery.
Declare and acquire your own permission in AndroidManifest.xml.
Listing 29.9 Adding a private permission (AndroidManifest.xml)
<manifest ...>
<permission android:name="com.bignerdranch.android.photogallery.PRIVATE"
android:protectionLevel="signature" />
...
Notice that you define a custom permission with a protection level of signature. You will learn
more about protection levels in just a moment. The permission itself is a simple string, just like intent
actions, categories, and system permissions you have used. You must always acquire a permission to
use it, even when you defined it yourself. Them’s the rules.
Take note of the shaded constant value above, by the way. This string needs to appear in three more
places and must be identical in each place. You would be wise to copy and paste it rather than typing it
out by hand.