722426 - Unnecessary android permission WRITE_SECURE_SETTINGS

Status: VERIFIED FIXED

(Firefox for Android Graveyard :: Android Sync, defect, P1)

Description

[David Chan [:dchan]]

The sync manifest requests WRITE_SECURE_SETTINGS [1]. This permission is only granted to system/firmware applications. [2]

Removing the permission should have no ill-effects on the application.


[1] - https://github.com/mozilla-services/android-sync/blob/master/manifests/SyncAndroidManifest_permissions.xml.in#L8
[2] - http://developer.android.com/reference/android/provider/Settings.Secure.html

Comment 1

[Richard Newman [:rnewman]]

Fixed in develop:

https://github.com/mozilla-services/android-sync/commit/f6d048f1a157e6597dfd1a6559aa17e1c3bf053f

Comment 2

[Nick Alexander :nalexander [he/him]]

Tested by:

1. hg clone m-c
2. git clone android-sync
3. apply patch to android-sync
4. code drop from android-sync as per android-sync/README
5. verify mobile/android/sync/manifests/SyncAndroidManifest_permissions.xml.in does not have WRITE_SECURE_SETTINGS
6. build m-c
7. verify fennec/Android Sync not installed on Android emulator
8. install fennec on Android emulator
9. run Android Sync on emulator; verify JPAKE code shown
10. run FF nightly in fresh test profile
11. Pair a Device in FF with JPAKE code shown in emulator
12. verify account appears in Android Sync

Comment 3

[Richard Newman [:rnewman]]

https://hg.mozilla.org/mozilla-central/rev/50dfa77287fc

Comment 4

[Richard Newman [:rnewman]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/d6581d4115cf

Comment 5

[Tracy Walker [:tracy]]

verified with Aurora nightly of 20120207