936723 - [keyboard] don't allow user to enable keyboard apps that don't have required trust level

Status: RESOLVED FIXED

(Firefox OS Graveyard :: Gaia::Keyboard, defect)

Description

[David Flanagan [:djf]]

If I write a 3rd party keyboard and make it certified or privileged, it works.

But if it is just an unprivileged app, I can still see it in the settings app, and I can enable it. When I try to use it, the keyboard appears, but the app doesn't have permission to use the keyboard API, so I can't type anything.

Also: I can't switch to another keyboard because the keyboard switching API also requires a higher level of permissions.  This means that I'm now trapped with a non-functional keyboard that I can't get rid of.  (Until I realize I can go back to the settings app to disable it.)

I think we might want to block on this because the user can get themselves trapped.

Comment 1

[David Flanagan [:djf]]

Rudy and Corey: do you think this is something easy to fix in shared/js/keyboard_helper.js:getApps()?

Comment 2

[Corey Frang [:gnarf]]

If whatever is needed is stored in the manifest, this is totally possible to fix inside getApps, yes.

Comment 3

[David Flanagan [:djf]]

Corey: I think that you just have to check for "type":"certified" or "type":"privileged". Unless an app has one of those in its manifest, it will not be able to function as a keyboard and should not be listed.

Comment 4

[Tim Guan-tin Chien [:timdream] (please needinfo)]

Rudy, please fix this?

Comment 5

[Rudy Lu [:rudyl] (inactive after 2015/7/3)]

I'll work on this.
Thanks for the heads-up.

Comment 6

[Rudy Lu [:rudyl] (inactive after 2015/7/3)]

Attachment: Patch V1 - pull request 13693

This patch is to filter out the apps that does not have input permission or is not certified, nor privileged apps in shared/js/keyboard_helper.js.

Hi Corey,

Could you help review this part of code?
Thanks.

Comment 7

[Rudy Lu [:rudyl] (inactive after 2015/7/3)]

Comment on attachment 832114 [details] [review]
Patch V1 - pull request 13693

Patch updated to also modify system/js/app_install_manager.js.

Need Gary to review this part.
Thanks.

Comment 8

[GaryChen [:GaryChen][:PYChen][:gchen][:陳柏宇]]

Comment on attachment 832114 [details] [review]
Patch V1 - pull request 13693

r=me with system/js/app_install_manager.js. part.

Thanks.

Comment 9

[Corey Frang [:gnarf]]

Comment on attachment 832114 [details] [review]
Patch V1 - pull request 13693

r=me - Looks great! Thanks for handling this one Rudy!

Comment 10

[Rudy Lu [:rudyl] (inactive after 2015/7/3)]

Merged,
https://github.com/mozilla-b2g/gaia/commit/c943970387dfc74c6c4e71a4e576424e593e8e97

Corey, Gary,
Thanks for the reviews.

Comment 11

[John Ford [:jhford] CET/CEST Berlin Time]

Uplifted c943970387dfc74c6c4e71a4e576424e593e8e97 to:
v1.2: bbe813e70ab89c604d02f8cf483b08e953e3e79a