Marshmallow on-demand permissions onabout cordova-plugin-code-push

[microsoft]

Marshmallow on-demand permissions on [email protected]

[lostintangent]

Yeah that is obviously not a good experience. Let us take a look into this and see what we can do to mitigate it. Stay tuned!

[dlebu]

Thanks for reporting this issue. One of our plugin dependencies (the file transfer plugin) does add the write external storage to the Android manifest file, which under the new permission rules, is a dangerous permission. However, to my knowledge, we never use that permission since we download the files to the application sandbox, not the phone external storage. So in theory, we should not see that permission dialog when installing the update.

Can you give me more details about your scenario?

• What kind of build are you running? Debug or release? Do I need to sign the apk?
• Were you on a device or emulator when reproducing the issue?

I tried to reproduce it on an emulator with a debug build unsuccessfully.

One quick way to fix this issue is to change your android target version to 22 like this (in config.xml):

<platform name="android">
        <preference name="android-minSdkVersion" value="YOUR_MIN_SDK_VERSION" />
        <preference name="android-targetSdkVersion" value="22" />
</platform>

Make sure your minimum sdk version is at most 22 as well. But this is not ideal and if this is a real issue we need to look into it.

[zwacky]

popup comes:

• tested on actual device (nexus 5), debug build

popup doesn't come:

• emulator (nexus 5), debug build

[zwacky]

setting the android-targetSdkVersion to 22 does fix it though.

[scottbommarito]

I just looked into this. The bug is caused by the Cordova file plugin, which, in its current release, always asks for the storage permission with any storage operation regardless of whether or not it actually requires it. They've fixed the issue, but it's not yet released. We could a quick modification to the plugin.xml file to resolve the problem and then revert the changes once they've made a release.

<dependency id="cordova-plugin-file" url="https://github.com/apache/cordova-plugin-file.git" commit="1e2593f42455aa78d7fff7400a834beb37a0683c" />
<dependency id="cordova-plugin-file-transfer" version=">=1.3.0" />

(it is important that file is before file-transfer in the dependencies, because otherwise file-transfer's dependencies install first and ignore what we specify here)

[dlebu]

The guys that fixed the bug are Microsoft employees. We should understand what is the timeline of the release before changing the dependency, since we already have a workaround.

[dlebu]

@rakatyal What is the schedule for releasing a new version of the Cordova file plugin to npm? We have this related issue in the CodePush plugin.

[rakatyal]

@dlebu: We have a plugin release in process right now. It should be out soon. I will update this thread once it's done.

[dlebu]

@rakatyal Thanks a lot!

[rakatyal]

The release has passed and I expect the npm packages to be released today or tomorrow. You can track the progress by following this mail thread.

[lostintangent]

This issue has been resolved and will be released to NPM this afternoon.