search

phonegap / phonegap-plugin-push

Register and receive push notifications
MIT License
1.94k stars 1.91k forks source link

Push notification not working, when disable export property in plugin.xml file #2802

Open grandhisubrahmanyam35 opened 5 years ago

grandhisubrahmanyam35 commented 5 years ago

Expected Behaviour

When I send notification from the Firebase/Google, we should get the notification to the registered device.

Steps to Reproduce

  1. Open plugin.xml file
  2. set android: export property value as false instead of true in plugin.xml file.
  3. send a dummy notification to the device, but unfortunately, notification not coming after the change.

Platform and Version (eg. Android 5.0 or iOS 9.2.1)

Mobile device platform= Android Mobile device version = 8.1.0

(Android) What device vendor (e.g. Samsung, HTC, Sony...)

device Model = Samsung(SM-G610F)

Cordova CLI version and cordova platform version

cordova --version                                    7.1.0
cordova platform version android           28.0.0

Plugin version

cordova plugin version | grep phonegap-plugin-push   1.11.1

What I have modifeid

In plugin.xml file, I modified the following code:

Activity Block: 

       <activity android:name="com.adobe.phonegap.push.PushHandlerActivity" android:exported="true" android:permission="${applicationId}.permission.PushHandlerActivity"/>

to 

       <activity android:name="com.adobe.phonegap.push.PushHandlerActivity" android:exported="false" android:permission="${applicationId}.permission.PushHandlerActivity"/>

Resource block: 

        <receiver android:name="com.google.android.gms.gcm.GcmReceiver" android:exported="true" android:permission="com.google.android.c2dm.permission.SEND">

to 

       <receiver android:name="com.google.android.gms.gcm.GcmReceiver" android:exported="false" android:permission="com.google.android.c2dm.permission.SEND">

Conclusion:

After I modify plugin.xml, push notification is not working and I am using plugin version: 1.11.1. The reason I modified plugin.xml is to avoid security vulnerability. Especially android:exported property exposing security vulnerability so I want to make that property as false.