search

amplitude / unity-plugin

Official Amplitude Unity Plugin
https://developers.amplitude.com/docs/unity
MIT License
44 stars 34 forks source link

Very bad permissions in Android com.amplitude.android-sdk-xxx.aar #36

Closed N0lex closed 4 years ago

N0lex commented 4 years ago

My game started asking for geolocation after integrating your SDK.

I started to analyze and found geolocation permission in the library com.amplitude.android-sdk-2.24.1.aar:

<uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" />
<uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION" />

These permissions should not be by default.

Please fix this!

Solution: Use tools:node="remove". Link: https://stackoverflow.com/questions/27997679/disable-dependency-permissions

Screenshot AndroidManifest.xml (in com.amplitude.android-sdk-2.24.1.aar):

amplitude_permissions

haoliu-amp commented 4 years ago

Have you refresh the android SDK to 2.25.1?

This was fixed in 2.25.1. Unity SDK 1.1.0 uses android 2.25.1. Pls check out release 1.1.0 https://github.com/amplitude/unity-plugin/releases/tag/v1.1.0

N0lex commented 4 years ago

I can not use this version (1.1.0). It crash the game (Android < 5.0).

More info: https://github.com/amplitude/unity-plugin/issues/35

haoliu-amp commented 4 years ago

Ok, old Unity SDK will not have this permission change. I wonder which version are you using currently? It doesn't have the crash for < 5.0 ?

N0lex commented 4 years ago

amplitude-unity_Feb 6, 2020.unitypackage - no crush (Android < 5.0).

haoliu-amp commented 4 years ago

Ok, I got it.

Amplitude SDK depends on okhttp library. The old SDK is the one using a very old version of okhttp 3.10.0.

Since Amplitude Unity SDK 1.0.0, we updated the okhttp to be 4.2.2, since it fixed a lot vulnerabilities.

However, okhttp dropped the support for < 5.0 since 3.13. Please read this. https://developer.squareup.com/blog/okhttp-3-13-requires-android-5/

But you can still use the new SDK with older version okhttp if you wanna get KitKat supported.

How to do it -

  1. If you import library by copying the jar file, you can downgrade okhttp library by replacing it with a version < 3.13.
  2. If you use google dependency resolver, update the dependency version for okhttp in *Dependency.xml file.
haoliu-amp commented 4 years ago

I am going to close this issue, we can move our discussion to your previous ticket.