remove: android.permission.REQUEST_INSTALL_PACKAGES from plugins.xml

[lincolnthree]

Expected Behaviour

Google is now requiring additional verification for the REQUEST_INSTALL_PACKAGES permission, and will start rejecting apps that have not submitted a valid use.

Developers should have control over which permissions are enabled or not.

Actual Behaviour

REQUEST_INSTALL_PACKAGES is forcibly activated in plugins.xml

Reproduce Scenario (including but not limited to)

[ipopa]

Hello, we had the same problem, you must to fork the plugin, remove the permission and delete the possibility to install/uninstall an apk with this plugin.

[lincolnthree]

Yeah, and I think there is more code that needs to be removed in the class, too. Don't forget the other functions, and imports.

[arnotixe]

+1 it seems possible to "just remove the setting from the plugin's config.xml and rebuild" but I think this feature is quite optional so it should be … optional somehow

[ryaa]

Here is the capacitor version of this plugin - see https://github.com/capacitor-community/file-opener
Note that this is for Android only at this moment.

[ryaa]

The support for iOS has been added. Can anyone, who uses capacitor, install from the github using the below command to give it a try
npm install capacitor-community/file-opener#chore/latest-version-with-dist-directory

[NGizdov]

Guys, do we expect this PR to be accepted and merged, because it is crucial for us, as the end date is quite close

[louisfelix]

As a temporary fix, until this PR is accepted, here is what we did to mitigate the emergency:

1. Fork the plugin and remove the REQUEST_INSTALL_PACKAGES permission (you can use our fork here)
2. In our project's package.json dev dependencies, replace "cordova-plugin-file-opener2": "^3.0.5" by "cordova-plugin-file-opener2": "git+https://github.com/CitadelApp/cordova-plugin-file-opener2.git"
3. Re-package everything and send to Google Play review: it has been accepted and the issue has been removed in Google Play Console -> Policy -> App concent

[benazir46]

@louisfelix it didn't work for me. I simply removed the permissions manually in vscode and it worked!

[xtoussaint-estel]

In my config.xml

<edit-config file="app/src/main/AndroidManifest.xml" target="/manifest" mode="remove">
<uses-permission android:name="android.permission.REQUEST_INSTALL_PACKAGES" />
</edit-config>

😋

Edit : I don't know why but my solution doesn't work anymore. The requested change is applied BEFORE the uses-permission is inserted in the AndroidManifest so it is still there 😕 I use the @adammaus script which works every time in my case.

[adammaus]

@xtoussaint-estel That didn't work for me but your answer led me to a script and hook in config.xml. Thank you!

I adapted a few stack overflow answers for the JS file below. Definitely test these out beforehand!

config.xml

<platform name="android">
    <hook src="scripts/remove-android-permissions.js" type="after_prepare" />

scripts/remove-android-permissions.js

#!/usr/bin/env node
//
// This hook removes specific permissions from the AndroidManifest.xml
// The AndroidManifest is re-generated during the prepare stage,
// so this must be run on the "after_prepare" hook.
//


// Configure the permissions to be forcefully removed.
// NOTE: These permissions will be removed regardless of how many plugins
//       require the permission. You can check the permission is only required
//       by the plugin you *think* needs it, by looking at the "count" shown in
//       your /plugins/android.json file.
//       If the count is more than 1, you should search through
//       the /plugins/<plugin-name>/plugin.xml files for <uses-permission> tags.

var permissionsToRemove = [ "REQUEST_INSTALL_PACKAGES" ];

var fs = require('fs');
var path = require('path');
var rootdir = process.argv[2];
var manifestFile = "platforms/android/app/src/main/AndroidManifest.xml";

fs.readFile( manifestFile, "utf8", function( err, data )
{
    if (err)
        return console.log( err );

    var result = data;
    for (var i=0; i<permissionsToRemove.length; i++)
        result = result.replace( "<uses-permission android:name=\"android.permission." + permissionsToRemove[i] + "\" />", "" );

    fs.writeFile( manifestFile, result, "utf8", function( err )
    {
        if (err)
            return console.log( err );
    } );
} );

For the bulk of the script
https://stackoverflow.com/a/42182147

For the manifestFile path:
https://stackoverflow.com/a/55563097

[zawmn]

Is there any update on this issue? Or is there any alternative plugin like this?