6
edits
Security/B2G/PermissionReview: Difference between revisions
Jump to navigation
Jump to search
Adding Gallery information
(Adding Gallery information) |
|||
| Line 107: | Line 107: | ||
An example of the possible temporary hosted app following this approach is available at: | An example of the possible temporary hosted app following this approach is available at: | ||
https://github.com/telefonicaid/gaia/tree/hosted-web/apps/music | https://github.com/telefonicaid/gaia/tree/hosted-web/apps/music | ||
=== Gallery Application === | |||
Gallery app is declaring the following permissions in its Manifest: | |||
*"audio-channel-content" | |||
**Ok, This permission is allowed to hosted content without any special prompt. | |||
*"device-storage:pictures" and "device-storage:videos" with "readwrite" access | |||
**These permissions area allowed to Trusted Hosted Content with a Prompt action so we assume an equivalent solution to expose this API to hosted apps would be available. Although this API was opened to Trusted Hosted Apps, Gallery Application was requiring Read/Write access, and we should reconsider if there is any way to expose read access to Gallery Content in a more secure way. | |||
**They are required to access the gallery content and artwork. | |||
**NOTE: Need to assess what would happen if user denies the permission. | |||
*"nfc-share" | |||
**NOT OK for hosted: only available to certified apps. | |||
**Enable an app to transmit data to other devices via near field communication. | |||
*"feature-detection" | |||
**Ok: This permission is allowed for privileged apps and has been allowed for Trusted Hosted apps. | |||
**Used for detect the device memory. If we have 256mb or less the app does exit. | |||
**This permission is used for a temporary workaround to bug 1039943 (https://bugzilla.mozilla.org/show_bug.cgi?id=1039943) | |||
*"themeable" | |||
**NOT OK: CERTIFIED | |||