title: Android 6.0 (Marshmallow) READ_CONTACTS permission allows to read Contact's name when permission is denied
body: <p>I want to check how new permission model works so in app's settings I disable <code>Contacts</code>. Then I go to app and try to read <code>Contacts</code> and ... it kinda works:</p>
  
  <pre><code>try {
      Uri result = data.getData();
      int contentIdx;
      cursor = getContentResolver().query(result, null, null, null, null);
      contentIdx = cursor.getColumnIndex(ContactsContract.Contacts.HAS_PHONE_NUMBER);
      if(cursor.moveToFirst()) {
          content = cursor.getInt(contentIdx);
      }
  
      if(content &gt; 0) {
          contentIdx = cursor.getColumnIndex(ContactsContract.Contacts.DISPLAY_NAME);
          if(cursor.moveToFirst()) {
              name = cursor.getString(contentIdx);
          }
          contentIdx = cursor.getColumnIndex(BaseColumns._ID);
          if(cursor.moveToFirst()) {
              content = cursor.getLong(contentIdx);
          }
          cursor = managedQuery(ContactsContract.CommonDataKinds.Phone.CONTENT_URI, new String[] { Phone.NUMBER }, Data.CONTACT_ID + "=?", new String[] { String.valueOf(content) }, null);
          if(cursor.moveToFirst()) {
              number = cursor.getString(cursor.getColumnIndex(Phone.NUMBER));
          }
      }
  } catch (Exception e) {
      //SecurityException
  }
  </code></pre>
  
  <ul>
  <li>I'm able to read Contact's Name</li>
  <li>when I try to read Contact's Number <code>SecurityException</code> is thrown</li>
  </ul>
  
  <blockquote>
    <p>java.lang.SecurityException: Permission Denial: reading com.android.providers.contacts.HtcContactsProvider2 uri content://com.android.contacts/data/phones from pid=20123, uid=10593 requires android.permission.READ_CONTACTS, or grantUriPermission()</p>
  </blockquote>
  
  <p>Why is that?</p>
  
  <p>Related stuff: <a href="https://code.google.com/p/android/issues/detail?id=77384&amp;q=READ_CONTACTS&amp;colspec=ID%20Status%20Priority%20Owner%20Summary%20Stars%20Reporter%20Opened" rel="noreferrer">Contact data leakage via pick activities</a></p>