815505 - [Settings] Installing an app that specifies a large amount of permissions - one permission is listed empty in app permissions

Status: RESOLVED WONTFIX

(Firefox OS Graveyard :: Gaia::Settings, defect, P1)

Description

[Jason Smith [:jsmith]]

Attachment: Missing Permission

Build:

Device - Unagi

Hashes

  <project name="gaia" path="gaia" remote="b2g" revision="176aea9cba4965594350f282751758b14d2624fc"/>
  <project name="releases/gecko" path="gecko" remote="mozillaorg" revision="4eaacd3fad7b6da220de206c0013dc0f307455c9"/>

Steps:

1. Install the web app from http://people.mozilla.com/~fdesre/openwebapps/test.html listed install app with permissions
2. Go to settings --> app permissions --> that app in particular
3. Scroll down the list of permissions

Expected:

All permissions called out in the permissions property in the manifest should be listed with the correct default permission levels.

Actual:

See attached screenshot. There's a permission getting listed here that's blank.

Comment 1

[Jason Smith [:jsmith]]

Blocking nom - listing permissions in the app permissions UI without a name is problematic, as the user has the ability to modify a permission without knowing what they are modifying.

Comment 2

[Chris Lee [:clee]]

Jason, do you know what permission is the blank one here and how common that one will be used?  I agree this is an issue and we shouldn't have blank lines here.

Comment 3

[Jason Smith [:jsmith]]

Looks like the permissions missing here are:

- network-events
- background-sensors

Don't know which one of these is the blank one. Don't know how common either.

Jonas - how often would we expect these permissions to be used by a hosted app?

Comment 4

[Etienne Segonzac (:etienne)]

Missing l10n key, assigning :stas.
Feel free to redirect if needed.

Comment 5

[:Margaret Leibovic]

Attachment: Link to https://github.com/mozilla-b2g/gaia/pull/6697

Following what Jason said in comment 3, I found the network-events entity name was wrong, and that we were missing the background-sensors entity completely.

I don't know if it matters where in the list I added 'background-sensors', also if "Background sensors" is the string we want. I'll cc lco to ask.

Comment 6

[:Margaret Leibovic]

lco, see my last comment. Is "Background sensors" the string we want to use for the background-sensors permission, and is there specific any place in the list of app permissions where you'd like to see it?

Comment 7

[:Margaret Leibovic]

Also, Jason, do you know of a list somewhere of all the permissions an app can have? We should verify that these are all in here:
https://mxr.mozilla.org/gaia/source/apps/settings/js/apps.js#10

(Also, aw yeah! MXR!)

Comment 8

[Jason Smith [:jsmith]]

(In reply to Margaret Leibovic [:margaret] from comment #7)
> Also, Jason, do you know of a list somewhere of all the permissions an app
> can have? We should verify that these are all in here:
> https://mxr.mozilla.org/gaia/source/apps/settings/js/apps.js#10
> 
> (Also, aw yeah! MXR!)

I was about to suggest using https://developer.mozilla.org/en-US/docs/Apps/Manifest#permissions but apparently after looking at that code, there's much more undocumented permission properties. Hmm...Jonas do you know the full list?

Comment 9

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

(In reply to Jason Smith [:jsmith] from comment #3)
> Looks like the permissions missing here are:
> 
> - network-events
> - background-sensors
> 
> Don't know which one of these is the blank one. Don't know how common either.
> 
> Jonas - how often would we expect these permissions to be used by a hosted
> app?

Neither of these permissions should be usable by hosted apps. Or non-privileged packaged apps. Network-events should only be permitted to certified apps.

Comment 10

[Jason Smith [:jsmith]]

(In reply to Jonas Sicking (:sicking) from comment #9)
> (In reply to Jason Smith [:jsmith] from comment #3)
> > Looks like the permissions missing here are:
> > 
> > - network-events
> > - background-sensors
> > 
> > Don't know which one of these is the blank one. Don't know how common either.
> > 
> > Jonas - how often would we expect these permissions to be used by a hosted
> > app?
> 
> Neither of these permissions should be usable by hosted apps. Or
> non-privileged packaged apps. Network-events should only be permitted to
> certified apps.

*email thread coming about this btw*

Sounds like the right patch to do here is that we should only call out permissions in that patch that make sense to be shown and be modified. If it doesn't make sense, we shouldn't show it.

Comment 11

[Jason Smith [:jsmith]]

After hearing the discussions in IRC and threads, I'm going to suggest closing this bug for now for the one off and opening a new bug to track harmonizing the permissions referenced for the settings app against the result of bug 815565 + clear input on what an end-user is actually allow to see and modify.

Does that align with everyone else?

Comment 12

[Jason Smith [:jsmith]]

Talked with Margaret in IRC - she agrees - I'm going to close this then.