Acclorite / book-story

Material3 eBook reader - Book's Story. Built with Jetpack Compose. Free & Open Source & Ad Free. 7 supported file formats (.txt, .pdf, .epub, .fb2, .zip, .html, .htm), 5 supported languages. Lots of customization.
GNU General Public License v3.0
241 stars 10 forks source link

Question on permissions used #36

Closed IzzySoft closed 1 month ago

IzzySoft commented 1 month ago

The scanner here at IzzyOnDroid told me…

! repo/ua.acclorite.book_story_6.apk declares sensitive permission(s): android.permission.READ_EXTERNAL_STORAGE android.permission.MANAGE_EXTERNAL_STORAGE

As book-story requires at least Android-8, I wonder what those permissions are needed for that's not covered by Storage Access Framework. Maybe you can clarify, so we can add it to the app's "green list" with the proper explanation? Thanks in advance!

Acclorite commented 1 month ago

Sure.

API Below 30: Grants only android.permission.READ_EXTERNAL_STORAGE. This permission does not have any effect in API 33+. API Above 30: Grants android.permission.MANAGE_EXTERNAL_STORAGE. Added in API 30, meaning it is useless and not valid on lower APIs.

_You can see granting process in BrowseViewModel_

Also I need to clarify, that I switch permissions at API 30+, because I had problems with using READ_EXTERNAL_STORAGE on API 30 (don't remember what it was). That's about why there are 2 permissions. Now about why I need those. Those permissions are used for scanning the whole device to find books (you can look at how I get them and use in getBooksFromFiles and getFilesFromDevice), maybe there are more "safe" ways, but this one is the most convenient one. And well, most Readers also include this permission.

Maybe you can clarify, so we can add it to the app's "green list" with the proper explanation?

"This permission is needed to scan Your Device for books, granting full access to read all files will ensure, that no books are missing and app can function properly".

Not now, but probably next release will have a big Browse screen update, where you will see File Tree with all supported files containing within folders, not sure if there is a permission that can do the same and grant me required access to improve the app. If you have more questions, ask.

IzzySoft commented 1 month ago

Nice – and thanks, added both permissions to the "green list", including the explanation. Should already be live – as is the green shield for the RB, which succeeded after I performed a soft-reset to the embedded commit hash ("first basic rule", remember? First commit, then build :wink:).

Acclorite commented 1 month ago

Didn't know though xD

IzzySoft commented 1 month ago

Hehe, but now you do :wink: See our hints on reproducible builds for more details if you wish.