Chore: android permissions

jrpie / Launcher

A distraction-free minimal homescreen for Android.

https://f-droid.org/packages/de.jrpie.android.launcher/index.html

Other

39 stars 6 forks source link

Chore: android permissions #22

Closed toby-bro closed 2 months ago

toby-bro commented 2 months ago

Modifications :

Since Android 11 it is not necessary to ask for WRITE_EXTERNAL_STORAGE and since Android 13 it is deprecated
Let Android studio reformat the file as he wanted
Added a permission to the exported field of settings to prevent any app from calling the launcher's settings (the exact permission can be discussed if you think of a more appropriate one)

jrpie commented 2 months ago

Why was WRITE_EXTERNAL_STORAGE even needed in the first place? Is this still left over from when the app managed the wallpaper itself?

jrpie commented 2 months ago

I don't understand what android:permission="android.permission.MANAGE_APP_PERMISSIONS" is supposed to do. Is that documented anywhere?

This declares a custom permission that is required to start the SettingsActivity, right? Then it should be something like "de.jrpie.android.launcher.<whatever>". Or is using android.permission.MANAGE_APP_PERMISSIONS a convention?

Why is it desirable to restrict access to that activity in such a way?

toby-bro commented 2 months ago

Write external storage was necessary before android 11 to be able to save app data on the phone. But since android 11 it is not needed as apps' storage is compartmentalised.

toby-bro commented 2 months ago

You're right this is weird... I thought it was suggested as autocomplete, but maybe it's copilot who hallucinated. After having checked the doc I think I'll have to change the permission to a real one 😅 (or at least a documented one)

The objective was making sure no app could change the settings malevolently, by enforcing a restrictive permission policy. I order for an app to access this activity it must have the permission level we specify (if I understood the documentation correctly)

jrpie commented 2 months ago

"Access" just means that other apps can launch an intent to start this activity. I don't see why that should be a problem.

jrpie commented 2 months ago

Merged this from CLI, somehow github doesn't detect it.