887708 - An app without permission shouldn't be able to relaunch itself.

Status: RESOLVED WONTFIX

(Core Graveyard :: DOM: Apps, defect)

Description

[(inactive after 6/18) Alive Kuo [:alive]]

STR:
1. Add this code in one app
  setInterval(function() {
    navigator.mozApps.getSelf().onsuccess = function _onAppReady(evt) {
      var app = evt.target.result;
      if (app)
        app.launch();
    }
  }, 5000);

Expect:
Nothing happens.

Actual:
Any app would be brought to foreground every 5sec with this code, without any permission restriction.

I see the need to getSelf() for every app, but is it reasonable to let app launch itself under any circumstance?

Comment 1

[(inactive after 6/18) Alive Kuo [:alive]]

Currently there're many apps using getSelf() then launch itself...

calendar/js/controllers/alarm.js:          app.launch();
-> Handle notification as system message
calendar/js/notification.js:        app.launch();
-> Handle notification click callback
communications/dialer/js/dialer.js:      app.launch('dialer');
-> Handle notification click
communications/dialer/js/dialer.js:              app.launch('dialer');
-> Handle notification as system message
communications/dialer/js/dialer.js:              request.result.launch('dialer');
-> Handle USSD as system message
costcontrol/js/app.js:          app.launch();
-> Handle Notification as system message
costcontrol/js/message_handler.js:          app.launch();
costcontrol/js/message_handler.js:          app.launch();
costcontrol/js/message_handler.js:          app.launch();
-> Not sure, relavant to notification callback maybe.
email/js/ext/mailapi/main-frame-setup.js:    gApp.launch();
-> Notification click handler I think.
settings/js/about.js:          ftuApp.launch('ftu');
settings/js/icc.js:      app.launch('settings');
settings/js/utils.js:    app.launch('settings');
-> I think settings has all permissions..
sms/js/activity_handler.js:          app.launch();
-> Sms System Message handler
sms/js/activity_handler.js:          app.launch();
-> Notification click callback
sms/js/activity_handler.js:      app.launch();
-> Notification system message handler


From above, my opinions:
* Why don't we brought the notification sender to foreground in system but make every app do this by itself?
* About other system message use case, it makes sense that some body want to deal with the system message in background and some needs to be foreground. So maybe we still need some permission check here...

Comment 2

[(inactive after 6/18) Alive Kuo [:alive]]

Fabrice:
(I see mostly your name here.... https://mxr.mozilla.org/mozilla-central/source/dom/apps/src/Webapps.jsm#2777)

Any idea?

Comment 3

[[:fabrice] Fabrice Desré]

Alive, that looks like the same discussion we have on dev-webapi?

Comment 4

[(inactive after 6/18) Alive Kuo [:alive]]

Yes. I don't know what we should do first so I filed a bug.

Comment 5

[(inactive after 6/18) Alive Kuo [:alive]]

Taken

Comment 6

[Sylvestre Ledru [:Sylvestre]]

Closing as Firefox OS is no longer a thing.