About the permissions

Post reply
0 favourites

  • Hi,

    So I received a mail from google play review team today that said my game was nominated for a feature in the google play store.

    They listed a few things that they wanted me to fix. Most were easy things to solve but they also asked me about the permissions the app requests.

    "Please remove any unnecessary permissions and/or explain how the permissions are being used. Additionally, make sure that when making use of these permissions, prompts follow the proper flow at run time."

    They wrote that the following permissions seems not necessary.

    • READ_PHONE_STATE

    • READ_EXTERNAL_STORAGE

    • WRITE_EXTERNAL_STORAGE

    Could someone from Scirra team explain a bit what these are used for and how/if they can be deleted.

  • I don't think the engine itself requires any of those permissions. Maybe Nepeo knows more. If you use any third-party addons it's possible those are requiring the permissions.

  • I think the file plugin we use in the c3runtime to get some assets sets the latter 2 as it's intended for general purpose file access, not sure about the 1st permission. I have been meaning to look into replacing the file plugin with something with less required permissions.

    In terms of removing the permissions you can likely do it by exporting as an Android Studio project, editing them out of the AndroidManifest.xml file and building a signed APK.

    Apparently some version of Google Play Services will add READ_PHONE_STATE and WRITE_EXTERNAL_STORAGE:

    stackoverflow.com/questions/39668549/why-has-the-read-phone-state-permission-been-added

  • Thanks for the help!

    I could only find <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" /> in the AndroidManifest.xml file. So that would be easy to edit out.

    I searched for "Read_External_Storage" and could find a few references to that in a file called "FileUtils.java"

    I could not find any reference to "Read_Phone_State". I use "gameanalytics" addon in my game. Perhaps I could ask them if their plugin uses the this permission?

    Is it possible to remove a permission that's not in the manifest?

    Edit: I just realized you can click "merged manifest" to find out more about the permissions. I can now see the permissions and where they come from.

    WRITE_EXTERNAL_STORAGE -> "Merging Log" Added from the app main manifest (this file), line 26

    <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" />

    READ_EXTERNAL_STORAGE -> "Merging Log" Implied from the app main manifest (this file), line 1; reason: org.apache.cordova requested WRITE_EXTERNAL_STORAGE

    READ_PHONE_STATE -> "Merging Log" Implied from the app main manifest (this file), line 1; reason: org.apache.cordova has a targetSdkVersion < 4

    Edit2: I also used — firebase plugin. Maybe they require some permissions?

  • Nope. The Firebase Master Collection doesn't use Cordova features.

    If you used the Mobile Master Collection, some of the addons there require additional permissions. But the Firebase Master Collection doesn't.

    Once I release the native mobile Firebase Master Collection plugins, there would be network permissions, but none of those permissions listed above.

    Also remember, until I release the 2.0 Firebase MC, it's still in-core, Rex's Web Firebase. No Cordova permissions there.

    I hope that cleared it out.

  • Ok, so after a bit of research I found that the reason READ_EXTERNAL_STORAGE and READ_PHONE_STATE was added was because I didn't to do the "automatic refactoring" to get rid of the error ("The minSdk version should not be declared in the[...]" issue) in android studio.

    I just deleted the lines that caused the error and never added them to the correct place. Android studio therefore added extra permissions because there was no minsdk defined.

    That's what I think was happening at least. Anyways "automatic refactoring" to solve the first error in android studio removed the permissions from the app bundle.

    This bug report is about the error you get when you export to android studio and how you can solve it.

    github.com/Scirra/Construct-3-bugs/issues/2875

  • Thanks for explaining the reasoning boulerzzz the gradle depreciation issue is frustrating, but at least we can work around it with the auto refactoring for now. Keeping my ear to the ground for cordova updates...

  • Hi boulerzzz, Nepeo

    I faced the same issue today - tried building my game using C3 build service and it requires a lot of things!

    1. Full network access
    2. Read the contents of your USB storage
    3. Modify or delete the contents of your USB storage
    4. Charges: Send MMS messages

    (There are no addons or plugins that need these permissions)

    I don't have any experience with Android Studio. Is it possible to get rid of these permissions when building with Cordova CLI? At least the USB storage ones. If they are added due to invalid minSDK or targetSDK parameters, where and how can I fix them?

    .

    EDIT: I managed to remove WRITE_EXTERNAL_STORAGE permission by erasing it from all .json and .xml files (after adding android platform), and then building with cordova. The app works, but it feels like a dirty hack, rather than a proper solution...

  • A vanilla export shouldn't request anything more than network access (if that...). It must be addons requesting those permissions. We'd need to see the project to work out which those might be.

  • A vanilla export shouldn't request anything more than network access

    Ashley Unfortunately it does. Here is a super-simple project with just Browser and Text objects and one event:

    dropbox.com/s/ywur7e1kzqjx8qj/PermissionTest.c3p

    And this is the AndroidManifest after building an apk with C3:

  • You listed three other permissions though, including accessing USB storage and sending MMS messages. Those must come from other plugins.

  • Ashley I listed what my phone is showing me when I install the app.

    Read and write USB storage are related to WRITE_EXTERNAL_STORAGE permission.

    Full network access = INTERNET permission.

    Not sure what "Charges: Send MMS messages" is about, it's shown after the app is installed.

    Anyway, both WRITE_EXTERNAL_STORAGE and INTERNET permissions should not be added. I built an app with just one text object and nothing else and these permissions are still there! So they definitely don't come from any plugins.

  • I filed https://github.com/Scirra/Construct-3-bugs/issues/3306 to look in to removing the default permissions.

  • I got these permission when I updated my game on Google Play last week:

    android.permission.ACCESS_NETWORK_STATE,

    android.permission.INTERNET,

    android.permission.READ_EXTERNAL_STORAGE,

    android.permission.WAKE_LOCK,

    android.permission.WRITE_EXTERNAL_STORAGE,

    com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

    The plugins I used was Dictionary, Local Storage, Browser, Mobile Advert & Google Play Game Services. I built it with the Construct Build Service. Min. Version 5.0 (Lollipop). Hide status bar checked.

    Are all those permissions necessary?

  • Try Construct 3

    Develop games in your browser. Powerful, performant & highly capable.

    Try Now Construct 3 users don't see these ads

  • Again, the only permissions the Construct engine itself requests are (currently) INTERNET and WRITE_EXTERNAL_STORAGE. Anything else will come from an addon you are using.

    Maybe we need a better way to indicate what will cause extra permissions to be requested.

Post reply
Return to board index
Jump to:
Active Users
There are 1 visitors browsing this topic (0 users and 1 guests)