From 9af654871e4a9697a3acdf7b7b052de34880975e Mon Sep 17 00:00:00 2001
From: simbadMarino <cctechmx@gmail.com>
Date: Fri, 15 Apr 2022 12:53:58 -0500
Subject: [PATCH] Vulnerabitlity fix as per Termux report:
 https://termux.org/general/2022/02/15/termux-apps-vulnerability-disclosures.html#termux-files-world-readable

---
 android/app/src/main/AndroidManifest.xml                  | 8 +++++---
 .../src/main/java/com/termux/app/TermuxOpenReceiver.java  | 2 +-
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/android/app/src/main/AndroidManifest.xml b/android/app/src/main/AndroidManifest.xml
index 42bc667..7b3bc96 100755
--- a/android/app/src/main/AndroidManifest.xml
+++ b/android/app/src/main/AndroidManifest.xml
@@ -189,11 +189,13 @@
         <receiver android:name="com.termux.app.TermuxOpenReceiver" />
 
 
-        <provider android:authorities="com.termux.files"
-            android:readPermission="android.permission.permRead"
+        <provider
+            android:name="com.termux.app.TermuxOpenReceiver$ContentProvider"
+            android:authorities="com.termux.files"
             android:exported="true"
             android:grantUriPermissions="true"
-            android:name="com.termux.app.TermuxOpenReceiver$ContentProvider" />
+            android:permission="com.termux.permission.RUN_COMMAND"
+             />
 
 
         <activity android:name="com.facebook.react.devsupport.DevSettingsActivity" />
diff --git a/android/app/src/main/java/com/termux/app/TermuxOpenReceiver.java b/android/app/src/main/java/com/termux/app/TermuxOpenReceiver.java
index c3609db..6dac28d 100755
--- a/android/app/src/main/java/com/termux/app/TermuxOpenReceiver.java
+++ b/android/app/src/main/java/com/termux/app/TermuxOpenReceiver.java
@@ -186,7 +186,7 @@ public ParcelFileDescriptor openFile(@NonNull Uri uri, @NonNull String mode) thr
             } catch (IOException e) {
                 throw new IllegalArgumentException(e);
             }
-            return ParcelFileDescriptor.open(file, ParcelFileDescriptor.MODE_READ_ONLY);
+            return ParcelFileDescriptor.open(file, ParcelFileDescriptor.parseMode(mode));
         }
     }