Confirmed users
1,225
edits
Security/B2G/PermissionReview: Difference between revisions
Jump to navigation
Jump to search
→Music Application
| Line 71: | Line 71: | ||
Music app is declaring the following permissions in its Manifest: | Music app is declaring the following permissions in its Manifest: | ||
*"audio-channel-content" | *"audio-channel-content" | ||
**This permission is allowed to hosted content without any special prompt | **Ok, This permission is allowed to hosted content without any special prompt. | ||
**It’s used for playing music. | **It’s used for playing music. | ||
*"device-storage:pictures" and "device-storage:music" with "readwrite" access | *"device-storage:pictures" and "device-storage:music" with "readwrite" access | ||
**OK for hosted: These permissions area allowed to Trusted Hosted Content with a Prompt action so we assume an equivalent solution to expose this API to hosted apps would be available. | **OK for hosted: These permissions area allowed to Trusted Hosted Content with a Prompt action so we assume an equivalent solution to expose this API to hosted apps would be available. Although this API was opened to Trusted Hosted Apps, Music Application was requiring Read/Write access, and we should reconsider if there is any way to expose read access to Music Content in a more secure way. | ||
**They are required to access the music content and artwork. | **They are required to access the music content and artwork. | ||
**NOTE: Need to assess what would happen if user denies the permission. | **NOTE: Need to assess what would happen if user denies the permission. | ||