android - Warning: Exported activity does not require permission

1. 什么情况下出现：
使用SDK版本为20 
创建工程后，添加一个自定义Activity并在manifest.xml中进行定义。

<application
        android:icon="@drawable/ic_launcher"
        android:label="@string/app_name"
        android:theme="@style/AppTheme" >
        <activity android:name=".MainActivity"
            android:label="@string/title_activity_main" >
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />
                <category android:name="android.intent.category.LAUNCHER" />
            </intent-filter>
        </activity>
        
        <activity android:name=".SecondActivity"
            android:exported="false">
            <intent-filter>
                <action android:name="android.intent.action.CREATE_SHORTCUT" />
            </intent-filter>
        </activity>
    </application>

添加intent-filter后就会报这个warning。

2. 错误原因:

这是因为添加了intent-filter后该Activity已经暴露给了不同进程的应用（其他应用程序），他们实例化该Activity不需要任何的权限。

当然你可以指定此Activity仅用于程序内部使用，或者添加权限。

3. 解决办法：

定义Activity的地方添加 android:exported="false" 或者定义权限。

        <activity android:name=".SecondActivity"
            android:exported="false">
            <intent-filter>
                <action android:name="android.intent.action.CREATE_SHORTCUT" />
            </intent-filter>
        </activity>

PS : 由于测试的Activity是为了做添加Activity对应的快捷方式到HomeScreen的，所以exported应该为true。要不然无法正常添加。

4. 参考：

http://stackoverflow.com/questions/11462936/exported-activity-does-not-require-permission-when-attempting-to-launch-from-a

http://developer.android.com/guide/topics/manifest/activity-element.html

http://developer.android.com/guide/topics/manifest/activity-element.html#prmsn

android:exported

Whether or not the activity can be launched by components of other applications — " true" if it can be, and " false" if not. If " false", the activity can be launched only by components of the same application or applications with the same user ID.

The default value depends on whether the activity contains intent filters. The absence of any filters means that the activity can be invoked only by specifying its exact class name. This implies that the activity is intended only for application-internal use (since others would not know the class name). So in this case, the default value is "false". On the other hand, the presence of at least one filter implies that the activity is intended for external use, so the default value is "true".

This attribute is not the only way to limit an activity's exposure to other applications. You can also use a permission to limit the external entities that can invoke the activity (see the permissionattribute).