Hi Cordova Developers,
I've been chatting with Erisu but looking to get more opinions on this
matter.
We have several plugins that declare WRITE_EXTERNAL_STORAGE permission,
which is semi-obsolete since API 19, and completely obsolete since API 29.
Starting with API 19, WRITE_EXTERNAL_STORAGE was only used if you wanted
to write to a file on external storage that was NOT owned by your
application. Starting with API 29 with Scoped Storage mechanisms, the
MediaStore API must be used which grants your application permission if
the owning app decides to grant it via it's content provider to a
specific file being requested.
While WRITE_EXTERNAL_STORAGE itself didn't grant any special permissions
on API 29+, it did implicitly still grant READ_EXTERNAL_STORAGE allowing
your app read files owned by other apps on external storage which became
obsolete in API 33.
To attempt to put things as simple as possible. If you're working with
files created by your app and only your app, no special permission are
needed on any SDK level we currently support. If you need write access
to other apps external files, then WRITE_EXTERNAL_STORAGE is required up
to API 28. API 29+ requires the use of MediaStore API. If your app needs
to read files owned by other apps, then READ_EXTERNAL_STORAGE is
required up API 32. API 33+ requires READ_MEDIA_* permissions, there is
a granular permission for IMAGES, VIDEO, and AUDIO. Other files types
requires MediaStore API.
Where this starts to get tricky is due to the edit-config munging
issues, if two plugins wants this permission, it needs be declared
identically otherwise conflicts will be triggered and Cordova will
refuse to install the plugin.
The options we kinda of thought of are as follows:
Option #1:
Remove WRITE_EXTERNAL_STORAGE declaration from our plugins. Our Min SDK
is now 24, this allows the app to still read and write files to external
storage for their own app usage. No additional permissions needed.
Our plugins may still have support for requesting permissions, but that
support will have to be opt in via edit-config / config-file entry
inside the config.xml, which should be documented respectively.
This should clear of any potential conflicts between Apache provided
Plugins and third-party plugins, but third-party plugins may still
conflict upon themselves and/or based on what the user has configured.
Option #2:
Support READ/WRITE_EXTERNAL_STORAGE for API 24-32 support, and
READ_MEDIA_* for API 33 support where it makes sense. (e.g.
cordova-plugin-camera may need READ_MEDIA_IMAGES while
cordova-plugin-media may need READ_MEDIA_AUDIO). This option has a high
risk of being incompatible with other plugins that requires external
storage use. This option would probably be the preferable one if we can
make our config munging smarter but that isn't an easy task to accomplish.
If there are any other ideas... would be nice to hear about them, but
personally I also feel Option #1 is probably the cleanest way forward I
think.
1.
https://developer.android.com/reference/android/Manifest.permission#WRITE_EXTERNAL_STORAGE
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@cordova.apache.org
For additional commands, e-mail: dev-h...@cordova.apache.org
