Closed Bug 1507531 Opened Last year Closed 10 months ago

FilePicker is missing WRITE_EXTERNAL_STORAGE permission


(Firefox for Android :: Settings and Preferences, defect, P2, major)




Firefox 67
Tracking Status
firefox66 --- wontfix
firefox67 --- verified


(Reporter: brent.dearth, Assigned: petru)



(2 files)

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:63.0) Gecko/20100101 Firefox/63.0

Steps to reproduce:

This was conducted on a stock Pixel 2 running Android 9 --

1. Visit a site where an image upload is required (ex - Facebook avatar upload). 
2. Click on the upload button and attempt to use the Camera intent to handle the upload, accepting any Camera permission dialogs.
3. Observe that the camera is displayed.
4. Take a picture and submit it via the Camera app.

Actual results:

Camera image was not accepted / processed by the site, once Firefox is resumed. 

If you perform the following, the Camera upload functionality works as expected:

1. Visit Android Settings -> App Permissions -> Firefox -> Permissions, and validate that the Camera and Storage settings are indeed enabled.
2. Toggle off all permissions.
3. Navigate back to App Permissions
4. Navigate back to App Permissions -> Firefox -> Permissions
5. Re-enable Camera and Storage permissions
6. Repeat reproduction steps 1-4, but observe that now the Camera intent passes the image correctly to the Firefox handled webpage

Expected results:

The Camera intent payload is received and processed correctly, initially, without the use of the above permission reset workaround.
Severity: normal → major
OS: Unspecified → Android
Hardware: Unspecified → x86_64
FWIW - this was also reproducible in the Android Studio official AVD image for the Pixel 2, which I used to create the screengrab. Hope it helps in debugging!

Thanks for your report!

I was able to reproduce this issue following the steps provided on with Google Pixel (Android 9). Marking the bug as new.

Ever confirmed: true
Hardware: x86_64 → ARM
Version: Firefox 63 → Trunk

Marking as a P2 per the triage.

Priority: -- → P2
Assignee: nobody → petru.lingurar

If our FilePicker delegates other applications to first record media, which has to be persisted locally before being picked up and uploaded it needs the WRITE_EXTERNAL_STORAGE permission.
At the moment we request only READ_EXTERNAL_STORAGE which was fine pre Oreo because Android would actually grant all permissions in the group if any one is granted.

Summary: Android Camera Permission Initially Broken → FilePicker is missing WRITE_EXTERNAL_STORAGE permission

"Prior to Android 8.0 (API level 26), if an app requested a permission at
runtime and the permission was granted, the system would also incorrectly
grant the app the rest of the permissions that belonged to the same permission
group, and that were registered in the manifest.

For apps targeting Android 8.0, this behavior has been corrected. The app is
granted only the permissions it has explicitly requested. However, once the
user grants a permission to the app, all subsequent requests for permissions
in that permission group are automatically granted."

Our FilePicker can delegate other applications to record media files
(photo/audio/video) which are then to be sent to websites. They must be saved
locally before the upload, scenario that wasn't possible anymore on Oreo+
because of the change in how Android handles runtime permissions.

As a way to get around this one could grant the "Storage" permission from
System Settings which would grant the app both READ and WRITE access.
But for actually being prepared to handle all situations our FilePicker must
ask for the WRITE_EXTERNAL_STORAGE permission at runtime.

Keywords: checkin-needed

Pushed by
FilePicker will request WRITE_EXTERNAL_STORAGE; r=JanH

Keywords: checkin-needed
Closed: 10 months ago
Resolution: --- → FIXED
Target Milestone: --- → Firefox 67

I think it's OK for this to ride to release with 67.

Verified as fixed on the latest Nightly build (67.0a1), I was able to change the picture on Twitter using the camera.
Device: Google Pixel (Android 9).

You need to log in before you can comment on or make changes to this bug.