1480079 - Check whether all builds require REQUEST_INSTALL_PACKAGES permission

Status: VERIFIED FIXED

(Firefox for Android Graveyard :: Download Manager, enhancement)

Description

[Jan Henning [:JanH]]

... so that users can directly install APK files they've downloaded through Firefox by launching the file from the download notification or about:downloads.

Comment 1

[Petru-Mugurel Lingurar [:petru]]

Indeed, just tested.
Thanks Jan!

Comment 2

[Petru-Mugurel Lingurar [:petru]]

Attachment: Bug 1480079 - Add REQUEST_INSTALL_PACKAGES permission for all builds;

This permission is needed on API26+ to be able to install app updates but also
other downloaded APKs.

Review commit: https://reviewboard.mozilla.org/r/261200/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/261200/

Comment 3

[(inactive) Jim Chen [:jchen] [:darchons]]

Hmm IIRC every time we add a permission like this the user will have to update manually from the Play Store. This results in a significant number of users not updating at all. In the past we have grouped new permissions together to release at the same time. So I think it's a product decision whether we want to hold off on adding this permission.

Maybe we want to open the downloads directory instead of installing the APK directly? Allowing direct APK installs has also been a security concern in the past.

Comment 4

[Jan Henning [:JanH]]

(In reply to Jim Chen [:jchen] [:darchons] from comment #3)
> Hmm IIRC every time we add a permission like this the user will have to
> update manually from the Play Store. This results in a significant number of
> users not updating at all. In the past we have grouped new permissions
> together to release at the same time. So I think it's a product decision
> whether we want to hold off on adding this permission.
> 
> Maybe we want to open the downloads directory instead of installing the APK
> directly? Allowing direct APK installs has also been a security concern in
> the past.

Other than the updater I don't think we're opening anything automatically, though, so users still have to click either the "download finished" notification or the completed download in about:downloads first. So I don't really see the benefit of additionally detouring them via a file manager first.

Peeking at Chrome's manifest, they
a) do declare that permission
b) declare it with <uses-permission-sdk-23>,

which might at least avoid a permission bump (if one is really required) on Android versions prior to Marshmallow. With any luck this might also actually work as a runtime permission on later Android versions, especially on O and therefore avoid a permission bump there as well.

Comment 5

[Jan Henning [:JanH]]

Also bug 1478970 landed in Nightly only yesterday, so couldn't we ask around to see whether that affected automatic updates in any way?

Plus according to https://developer.android.com/guide/topics/permissions/overview#permission-groups, REQUEST_INSTALL_PACKAGES isn't listed among the "dangerous" permissions that require explicit user consent, so we should be fine anyway, especially if we also switch to declaring it with <uses-permission-sdk-23>.

Comment 6

[(inactive) Jim Chen [:jchen] [:darchons]]

Comment on attachment 8997424 [details]
Bug 1480079 - Add REQUEST_INSTALL_PACKAGES permission for all builds;

https://reviewboard.mozilla.org/r/261200/#review268552

Adding `<uses-permission-sdk-23>` sounds like a good plan

Comment 7

[Petru-Mugurel Lingurar [:petru]]

Comment on attachment 8997424 [details]
Bug 1480079 - Add REQUEST_INSTALL_PACKAGES permission for all builds;

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/261200/diff/1-2/

Comment 8

[Petru-Mugurel Lingurar [:petru]]

Comment on attachment 8997424 [details]
Bug 1480079 - Add REQUEST_INSTALL_PACKAGES permission for all builds;

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/261200/diff/2-3/

Comment 9

[:sdaswani]

Jim, thanks for flagging this. I believe Jan that it's not a dangerous permission, but I want QA to validate this. Sorina can you validate that the user won't have to manually update?

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8865d2752c66
Add REQUEST_INSTALL_PACKAGES permission for all builds; r=jchen

Comment 11

[Cristian Brindusan [:cbrindusan]]

https://hg.mozilla.org/mozilla-central/rev/8865d2752c66

Comment 12

[Sorina Florean [:sflorean]]

Updated an older Nightly build from the Play store on the following devices: 
- Xiaomi Mi4i(Android 5.0.2) 
- Prestigio Grace X5(Android 4.4.2) 
- Xiaomi Mi Pad 2(Android 5.1 - x86 architecture) 
- Google Pixel(Android 9) 
- Samsung Galaxy note8(Android 8.0.0) and no prompt about a new permission were displayed and all was working normally.