1624513 - optional permissions are not shown in about:addons

Status: RESOLVED FIXED

(Toolkit :: Add-ons Manager, enhancement, P2)

Description

[hong620]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0

Steps to reproduce:

Certain Extension demand 'Unlimited Client Data Access' cause of new functions from update.

so I try to exclude certain Permission privilege from the extension setting UI for block.

Actual results:

Firefox only had Doorhanger UI for 'Allow or disallow Permission request from Extension'

not the Direct adjustable UI for blocking permission from Extension Setting.

Expected results:

it cause the 'forcing use or not' issue to extension user,
certain extension could be abusing doorhanger popup screen from extension update to 'dump the respons to user agreement'

this kind of UI issue is simmilar one with Old Firefox's Pop-up allowing issue.

so have to supply UI for user can allow/disallow certain indivisual permission from Extension Setting screen.
just like other OS like Windows, Android XPrivacy, Android Lineage OS's privacy management UI and other varient like Samsung's one.

Comment 1

[hong620]

Attachment: 캡처.PNG

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

Bugbug thinks this bug should belong to this component, but please revert this change in case of error.

Comment 3

[Marcela (Please NI request to Brindusa Tot)]

Thanks for taking the time to add this issue, looks like an enhancement.
I'm not sure if WebExtension> Frontend is the correct component. Frontend Team, if this is not the right component please feel free to route this ticket to the corresponding team, thanks!

Comment 4

[Luca Greco [:rpl] [:luca] [:lgreco]]

This would only be possible for the permissions that are actually requested as optional, but it is a reasonable enhancement and we discussed about it before and from what I recall we all agreed that the permission tab in the addon detail view would be a good place to provide it to the users.

In the meantime, I'm moving it to the Add-ons Manager component, because this is actually an enhancement of the about:addons page.

Comment 5

[Shane Caraveo (:mixedpuppy)]

In retrospect, this is a more important issue than P3. Users have no way to even see what permissions have been granted to an addon if those permissions were optional. And since we need to list them, we may as well make it possible for the user to revoke those.

Comment 6

[Shane Caraveo (:mixedpuppy)]

Attachment: Bug 1624513 add optional permission controls to about:addons

Comment 7

[Shane Caraveo (:mixedpuppy)]

Comment on attachment 9167782 [details]
Bug 1624513 add optional permission controls to about:addons

still WIP on this patch, but worth getting a look at now.

Comment 8

[Luca Greco [:rpl] [:luca] [:lgreco]]

Comment on attachment 9167782 [details]
Bug 1624513 add optional permission controls to about:addons

I just added an initial round of feedback comments on phabricator (I may not be notified from phabricator when you are going to comment on it, and so it may be to flag me again here on bugzilla to make sure that I don't miss your comments or an update of the patch)

Comment 9

[Shane Caraveo (:mixedpuppy)]

Attachment: permissions refrersh

From Aaron, but not yet finished

Comment 10

[Shane Caraveo (:mixedpuppy)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=69b43337e5da840bc144878377a58d6d155f6bdf

Comment 11

[Hades]

Its possible for Addons to request permissions they dont really need or offer only a very small benefit compared to the risk of the required permission.

So keep in mind to offer the option to enable/disable EVERY SINGLE PERMISSION Addon user have more experience, so if they want more security they can test how an addon will behave after removing a required permission and can maybe contact the developper.

On the right, you say, only ~1% of FF users use Addons, so the change to WE will not affect most of the users and heavily increase security.

On the left, you act and code as if the 1% of FF users are not mature enough to decide on every permission.

So what?? Are professional users who's work depend on Keyboard shortcuts, Hidden/MultiRow TabStrip, Portability, Cross-Addon support of session/trees/groups/containers really your enemies?

I still have the hope that one day the majority of Firefox developers will wake up and wonder: Will a casual user (who just reads emails and writes documents) look for an alternative browser after having an OEM system with a pre-installed browser bought. Or are / were professional users praising the privacy, customization, and multitasking that installed Firefox on every single system of family / friends / customers and made Firefox great? In order to meet the needs of professionals, it is not even necessary to invest a lot of time if you devote a few months to them.

Comment 12

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/95404de0380e
add optional permission controls to about:addons r=rpl,mstriemer,fluent-reviewers,flod

Comment 13

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/95404de0380e

Comment 14

[Marcela (Please NI request to Brindusa Tot)]

Hi hong620!
Can you tell us if this issue is still reproducible on latest Nightly? You can download it from here: https://nightly.mozilla.org/
Thanks!

Comment 15

[hong620]

(In reply to Marcela (Please NI request to Brindusa Tot) from comment #14)

Hi hong620!
Can you tell us if this issue is still reproducible on latest Nightly? You can download it from here: https://nightly.mozilla.org/
Thanks!

https://imgur.com/a/Wvw0KB1
https://imgur.com/a/VQ1rS0o

no issue to control optional permissions of addons.