Remove unnecessary permissions, fixes #5886 #12965

clayallsopp · 2017-03-16T00:15:09Z

Motivation

The current react-native init generates a project with unreasonable default permissions:

SYSTEM_ALERT_WINDOW is used for debugging, but should be removed for release in almost all cases
WRITE_EXTERNAL_STORAGE, READ_EXTERNAL_STORAGE, and READ_PHONE_STATE are implicitly added due to android-jsc (see Add minSdkVersion to AndroidManifest.xml facebookarchive/android-jsc#12, which has not been pulled into React Native proper yet)

See #5886 for more details - this is one implementation of a proposed solution, the only one I could get working, happy to adjust with feedback though

Test Plan

Tried to get init working locally but rather tough - any thoughts?

mkonicek · 2017-03-16T00:23:40Z

SYSTEM_ALERT_WINDOW is used for debugging, but should be removed for release in almost all cases

Good point!

WRITE_EXTERNAL_STORAGE, READ_EXTERNAL_STORAGE

I believe this one is for AsyncStorage? Maybe OK to include by default? Would Android warn about these? They seem very basic.

and READ_PHONE_STATE are implicitly added due to android-jsc (see facebookarchive/android-jsc#12, which has not been pulled into React Native proper yet)

Ah so it looks like someone needs to release a new version of the android-jsc and we need to update our dependency, right? EDIT: OK get it, with this PR we don't need to release a new version of android-jsc.

mkonicek · 2017-03-16T00:25:19Z

local-cli/templates/HelloWorld/android/app/src/main/AndroidManifest.xml

+    <!-- The following lines can be removed after android-jsc is updated in react-native -->
+    <uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" tools:node="remove" />
+    <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" tools:node="remove" />
+    <uses-permission android:name="android.permission.READ_PHONE_STATE" tools:node="remove"/>


Nice trick!

mkonicek · 2017-03-16T00:25:42Z

local-cli/templates/HelloWorld/android/app/src/main/AndroidManifest.xml

+    <!-- These permissions are added implicitly by android-jsc, see https://github.com/facebook/android-jsc/pull/12 -->
+    <!-- The following lines can be removed after android-jsc is updated in react-native -->
+    <uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" tools:node="remove" />
+    <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" tools:node="remove" />


These are probably for AsyncStorage so we should keep them? Not sure.

I think one module that needs read permissions is CameraRoll. I fixed it recently because we didn't request the permission in UIExplorer on Android 23+.

I tried AsyncStorage without this permission and it works fine. I guess under the hood it uses SQLite from Android so it does not really need this permission.

AsyncStorage Uses SQLite which saves to the app's local storage which doesn't require a permission.

However CameraRoll will require READ_EXTERNAL_STORAGE (for getPhotos) & WRITE_EXTERNAL_STORAGE (for saveToCameraRoll)

mkonicek · 2017-03-16T00:26:14Z

local-cli/templates/HelloWorld/android/app/src/release/AndroidManifest.xml

+    >
+
+    <!-- These are added by React Native for debug mode, but aren't needed in release mode -->
+    <uses-permission android:name="android.permission.SYSTEM_ALERT_WINDOW" tools:node="remove" />


Nice trick!

mkonicek · 2017-03-16T00:28:41Z

Thanks for doing this! Not merging yet because we might want to keep the storage permissions? If we keep the storage permissions is it really easy for people to remove them in their apps if they're not needed? I'm asking because using storage seems like a very basic thing and not sure if it's an issue by allowing that by default.

mkonicek · 2017-03-16T00:30:29Z

Testing 'react-native init' locally is quite complicated indeed. I do it quite often and this guide should work: https://github.com/facebook/react-native/tree/master/react-native-cli

clayallsopp · 2017-03-16T14:58:24Z

@mkonicek thanks for the fast review!

I followed the instructions locally, but the full Android build failed. I see there's additional dev instructions for Android, but they aren't working for me. When I run ./gradlew :ReactAndroid:installArchives from the react-native root directory, it fails with java.lang.IllegalStateException: buildToolsVersion is not specified. I see that buildToolsVersion is set in ReactAndroid/build.gradle, so not sure what's going on - is that expected?

However, ./gradlew :app:processReleaseManifest does work and the final manifest does not have the permissions that are to be removed in the PR: https://gist.github.com/clayallsopp/ce2d57c26d4bf5afebd39e3b47a25242 (via cat app/build/intermediates/manifests/full/release/AndroidManifest.xml)

For comparison, this is :app:processDebugManifest on the PR https://gist.github.com/clayallsopp/2e606a8e06bd9c2b199815fb203a15ea, and this is :app:processReleaseManifest on master: https://gist.github.com/clayallsopp/72c7c8b9fcce1360e32dacfa61211d5e

As for AsyncStorage, under the hood it looks like it uses SQLiteOpenHelper, which by default and as far as I can tell in React Native does not use external storage (see questions like these)

clayallsopp · 2017-03-16T15:00:38Z

One other thing to note - when building the Android app, there is now this additional output for the three implicit permissions in question:

Warning:
        uses-permission#android.permission.READ_EXTERNAL_STORAGE was tagged at AndroidManifest.xml:12 to remove other declarations but no other declaration present

This seems to be an open issue on the build tools, but is harmless otherwise

janicduplessis · 2017-03-18T19:01:02Z

local-cli/templates/HelloWorld/android/app/src/main/AndroidManifest.xml

    package="com.helloworld"
    android:versionCode="1"
    android:versionName="1.0">

    <uses-permission android:name="android.permission.INTERNET" />
    <uses-permission android:name="android.permission.SYSTEM_ALERT_WINDOW"/>

+    <!-- These permissions are added implicitly by android-jsc, see https://github.com/facebook/android-jsc/pull/12 -->
+    <!-- The following lines can be removed after android-jsc is updated in react-native -->
+    <uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" tools:node="remove" />


I think we should make it clear here that this does not add the permissions and what needs to be done if someone wants to add those to their app (probably just remove tools:node="remove").

clayallsopp · 2017-04-11T19:28:54Z

@mkonicek any feedback to move this forward?

I think the extra permissions needed for specific modules (i.e. camera) should be added in the docs rather than defaults, since not all apps will need them (and the template app doesn't need them either) - happy to make those doc edits in this PR as well

facebook-github-bot · 2017-08-11T17:02:33Z

@clayallsopp I tried to find reviewers for this pull request and wanted to ping them to take another look. However, based on the blame information for the files in this pull request I couldn't find any reviewers. This sometimes happens when the files in the pull request are new or don't exist on master anymore. Is this pull request still relevant? If yes could you please rebase? In case you know who has context on this code feel free to mention them in a comment (one person is fine). Thanks for reading and hope you will continue contributing to the project.

stale · 2017-10-13T05:36:24Z

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Maybe the issue has been fixed in a recent release, or perhaps it is not affecting a lot of people. If you think this issue should definitely remain open, please let us know why. Thank you for your contributions.

joshfriend · 2017-10-20T12:46:47Z

Was this fixed another way? If not it should certainly remain open!

wprater · 2017-12-29T18:51:48Z

agree, should we reopen this one?

makovkastar · 2018-02-26T16:29:48Z

@facebook-github-bot reopen

facebook-github-bot · 2018-02-26T16:30:09Z

Something went wrong executing that command, @hramos could you take a look?

praveenav · 2018-06-11T10:48:02Z

Any updates on this issue?
I created an app using react-native init. My app just displays few lines of hardcoded text on the screen. The app doesn't use any other feature whatsoever. I am trying to launch it in play store.

But I am getting the following error: Your APK or Android App Bundle is using permissions that require a privacy policy: (android.permission.READ_PHONE_STATE)

I can add a privacy policy just for the sake of it. But users will become suspicious if my dead simple app requires permission READ_PHONE_STATE! Doesn't it make my app look like a malware or something!

Please suggest a workaround if any.

Summary: This sync includes the following changes: - **[ae14317d6](facebook/react@ae14317d6)**: Inline fbjs/lib/emptyFunction (#13054) //<Dan Abramov>// - **[72434a768](facebook/react@72434a768)**: Remove or inline some fbjs dependencies (#13046) //<Dan Abramov>// - **[64c54edea](facebook/react@64c54edea)**: Adding movementX and movementY to synthenticMouseEvent fixes #6723 (#9018) //<Jason Williams>// - **[9bd4d1fae](facebook/react@9bd4d1fae)**: Synchronously restart when an error is thrown during async rendering (#13041) //<Andrew Clark>// - **[9bda7b28f](facebook/react@9bda7b28f)**: Suspended high pri work forces lower priority work to expire early (#12965) //<Andrew Clark>// - **[2e7577907](facebook/react@2e7577907)**: Fix incorrect data in compositionend event with Korean IME on IE11 (#10217) (#12563) //<Crux>// - **[bc963f353](facebook/react@bc963f353)**: setJSResponder in Fabric renderer (#13031) //<Sebastian Markbåge>// - **[051637da6](facebook/react@051637da6)**: Extract Fabric event handlers from canonical props (#13024) //<Sebastian Markbåge>// - **[2a8085980](facebook/react@2a8085980)**: Remove rAF fork (#12980) //<Flarnie Marchan>// - **[e0c78344e](facebook/react@e0c78344e)**: Retry on error if there's lower priority pending work (#12957) //<Andrew Clark>// - **[9725065eb](facebook/react@9725065eb)**: Update bundle sizes for 16.4.1 release //<Dan Abramov>// - **[0b87b2790](facebook/react@0b87b2790)**: Updating package versions for release 16.4.1 //<Dan Abramov>// - **[036ae3c6e](facebook/react@036ae3c6e)**: Use native event dispatching instead of Simulate or SimulateNative (#13023) //<Philipp Spieß>// - **[945fc1bfc](facebook/react@945fc1bfc)**: Call gDSFP with the right state in react-test-render (#13030) //<Rafał Ruciński>// - **[392530104](facebook/react@392530104)**: Remove feature flag around 'getDerivedStateFromProps' bug fix (#13022) //<Flarnie Marchan>// - **[1594409fa](facebook/react@1594409fa)**: Scheduler depends on common packages (#13020) //<Dan Abramov>// - **[d5c11193e](facebook/react@d5c11193e)**: Added production profiling bundle type (#12886) //<Brian Vaughn>// - **[ec60457bc](facebook/react@ec60457bc)**: Popping context is O(1) in SSR (#13019) //<Dan Abramov>// - **[30bc8ef79](facebook/react@30bc8ef79)**: Allow multiple root children in test renderer traversal API (#13017) //<Dan Abramov>// - **[d480782c4](facebook/react@d480782c4)**: Don’t error when returning an empty Fragment (#12966) //<Philipp Spieß>// - **[4ac6f133a](facebook/react@4ac6f133a)**: Fallback to event.srcElement for IE9 (#12976) //<Nathan Hunzaker>// - **[23be4102d](facebook/react@23be4102d)**: Fixed an issue with nested contexts unwinding when server rendering. Issue #12984 (#12985) //<Eric Soderberg>// - **[d0d428064](facebook/react@d0d428064)**: Remove old reference to inst._wrapperState (#12987) //<Nathan Hunzaker>// - **[c78957eac](facebook/react@c78957eac)**: Fix an SVG focusing crash in IE11 (#12996) //<Jifa Jiang>// - **[bfb12ebb5](facebook/react@bfb12ebb5)**: delete a couple of redundant lines in performWorkOnRoot() in ReactFiberScheduler.js (#13003) //<Nathan Quarles>// - **[394b17eed](facebook/react@394b17eed)**: Update custom renderer docs //<Dan Abramov>// - **[188c4252a](facebook/react@188c4252a)**: Fix react-dom ReferenceError requestAnimationFrame in non-browser env (#13000) (#13001) //<Ivan Babak>// - **[9cf3733a9](facebook/react@9cf3733a9)**: update comment in computeAsyncExpiration() to reflect code (#12994) //<Nathan Quarles>// - **[c5a733e1e](facebook/react@c5a733e1e)**: Fix links of docs on the comment (#12795) //<Ende93>// - **[36546b513](facebook/react@36546b513)**: Set the correct initial value on input range (#12939) //<Maxime Nory>// - **[15767a8f8](facebook/react@15767a8f8)**: [scheduler] 5/n Error handling in scheduler (#12920) //<Flarnie Marchan>// - **[3118ed9d6](facebook/react@3118ed9d6)**: Expose unstable_interactiveUpdates on ReactDOM (#12943) //<Andrew Clark>// - **[524a74331](facebook/react@524a74331)**: Fix for Flow issues in SimpleCacheProvider (#12942) //<Flarnie Marchan>// - **[ae57b125c](facebook/react@ae57b125c)**: [simple-cache-provider] Use LRU cache eviction (#12851) //<Andrew Clark>// - **[e0a03c1b4](facebook/react@e0a03c1b4)**: Extend input type check in selection capabilities (#12062) (#12135) //<Spyros Ioakeimidis>// - **[79a740c6e](facebook/react@79a740c6e)**: Rename variables to remove references to 'global' global (#12931) //<Flarnie Marchan>// - **[ff724d3c2](facebook/react@ff724d3c2)**: [scheduler] 4/n Allow splitting out `schedule` in fb-www, prepare to fix polyfill issue internally (#12900) //<Flarnie Marchan>// - **[83f76e4db](facebook/react@83f76e4db)**: ForwardRefs supports propTypes (#12911) //<Brian Vaughn>// - **[8aeea5afa](facebook/react@8aeea5afa)**: Do not assign node.value on input creation if no change will occur (#12925) //<Nathan Hunzaker>// - **[aa85b0fd5](facebook/react@aa85b0fd5)**: Upgrade to Jest 23 (#12894) //<Simen Bekkhus>// - **[61777a78f](facebook/react@61777a78f)**: [scheduler] 3/n Use a linked list instead of map and queue for callback storage (#12893) //<Flarnie Marchan>// - **[e7bd3d59a](facebook/react@e7bd3d59a)**: No longer expose ReactNativeComponentTree (#12904) //<Sebastian Markbåge>// - **[f35d989be](facebook/react@f35d989be)**: TestRenderer warns if flushThrough is passed the wrong params (#12909) //<Brian Vaughn>// - **[557870067](facebook/react@557870067)**: Record "actual" times for all Fibers within a Profiler tree (alt) (#12910) //<Brian Vaughn>// - **[76e07071a](facebook/react@76e07071a)**: [scheduler] 2/n Adding 'schedule' fixture (#12884) //<Flarnie Marchan>// - **[345e0a71a](facebook/react@345e0a71a)**: Improve tests for 'schedule' module (#12880) //<Flarnie Marchan>// - **[8765d6089](facebook/react@8765d6089)**: Update bundle sizes for 16.4.0 release //<Andrew Clark>// - **[d427a563d](facebook/react@d427a563d)**: Updating package versions for release 16.4.0 //<Andrew Clark>// - **[53852a887](facebook/react@53852a887)**: add functional components warning about legacy context api (#12892) //<Chang Yan>// - **[fe747a51c](facebook/react@fe747a51c)**: Add React.Timeout to getComponentName (#12890) //<Toru Kobayashi>// - **[c601f7a64](facebook/react@c601f7a64)**: add siblings Timeout components test case (#12862) //<Chang Yan>// - **[735035837](facebook/react@735035837)**: add legacy context API warning in strict mode (#12849) //<Chang Yan>// - **[e88579184](facebook/react@e88579184)**: Fix a regression that caused us to listen to extra events at the top (#12878) //<Dan Abramov>// - **[7c0aca289](facebook/react@7c0aca289)**: Rollup freeze: false (#12879) //<Brian Vaughn>// - **[33289b530](facebook/react@33289b530)**: Tests and fixes for 'timing out' behavior (#12858) //<Flarnie Marchan>// - **[ad27845cc](facebook/react@ad27845cc)**: Fix double-firing submit events (#12877) //<Sophie Alpert>// - **[dd5fad296](facebook/react@dd5fad296)**: Update Flow to 0.70 (#12875) //<Dan Abramov>// - **[13003654e](facebook/react@13003654e)**: Pass "start time" and "commit time" to Profiler callback (#12852) //<Brian Vaughn>// - **[dc3b144f4](facebook/react@dc3b144f4)**: Treat Rollup "warnings" as errors (#12868) //<Dan Abramov>// - **[d7b9b4921](facebook/react@d7b9b4921)**: Fix react native example links in README of 'react-reconciler' (#12871) //<Kevin (Kun) "Kassimo" Qian>// - **[9bed4a6ae](facebook/react@9bed4a6ae)**: https in reactProdInvariant text (#12869) //<Sophie Alpert>// - **[47b003a82](facebook/react@47b003a82)**: Resolve host configs at build time (#12792) //<Dan Abramov>// Release Notes: [GENERAL] [FEATURE] [React] - React sync for revisions c0fe8d6...ae14317 Reviewed By: bvaughn Differential Revision: D8458731 fbshipit-source-id: afefaa50685d43e70c8ea85c70d2e29dee311cbb

praveenav · 2018-06-20T12:19:45Z

Thanks @clayallsopp. I took your approach to solve the problem.

I got this working by adding following lines to my AndroidManifest.xml.

<uses-permission android:name="android.permission.READ_PHONE_STATE" tools:node="remove"/> <uses-permission android:name="android.permission.SYSTEM_ALERT_WINDOW" tools:node="remove"/> <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" tools:node="remove"/> <uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" tools:node="remove"/>

And included the attribute xmlns:tools="http://schemas.android.com/tools" in the maifest element of AndroidManifest.xml.

Summary: This sync includes the following changes: - **[ae14317d6](facebook/react@ae14317d6)**: Inline fbjs/lib/emptyFunction (#13054) //<Dan Abramov>// - **[72434a768](facebook/react@72434a768)**: Remove or inline some fbjs dependencies (#13046) //<Dan Abramov>// - **[64c54edea](facebook/react@64c54edea)**: Adding movementX and movementY to synthenticMouseEvent fixes #6723 (#9018) //<Jason Williams>// - **[9bd4d1fae](facebook/react@9bd4d1fae)**: Synchronously restart when an error is thrown during async rendering (#13041) //<Andrew Clark>// - **[9bda7b28f](facebook/react@9bda7b28f)**: Suspended high pri work forces lower priority work to expire early (#12965) //<Andrew Clark>// - **[2e7577907](facebook/react@2e7577907)**: Fix incorrect data in compositionend event with Korean IME on IE11 (#10217) (#12563) //<Crux>// - **[bc963f353](facebook/react@bc963f353)**: setJSResponder in Fabric renderer (#13031) //<Sebastian Markbåge>// - **[051637da6](facebook/react@051637da6)**: Extract Fabric event handlers from canonical props (#13024) //<Sebastian Markbåge>// - **[2a8085980](facebook/react@2a8085980)**: Remove rAF fork (#12980) //<Flarnie Marchan>// - **[e0c78344e](facebook/react@e0c78344e)**: Retry on error if there's lower priority pending work (#12957) //<Andrew Clark>// - **[9725065eb](facebook/react@9725065eb)**: Update bundle sizes for 16.4.1 release //<Dan Abramov>// - **[0b87b2790](facebook/react@0b87b2790)**: Updating package versions for release 16.4.1 //<Dan Abramov>// - **[036ae3c6e](facebook/react@036ae3c6e)**: Use native event dispatching instead of Simulate or SimulateNative (#13023) //<Philipp Spieß>// - **[945fc1bfc](facebook/react@945fc1bfc)**: Call gDSFP with the right state in react-test-render (#13030) //<Rafał Ruciński>// - **[392530104](facebook/react@392530104)**: Remove feature flag around 'getDerivedStateFromProps' bug fix (#13022) //<Flarnie Marchan>// - **[1594409fa](facebook/react@1594409fa)**: Scheduler depends on common packages (#13020) //<Dan Abramov>// - **[d5c11193e](facebook/react@d5c11193e)**: Added production profiling bundle type (#12886) //<Brian Vaughn>// - **[ec60457bc](facebook/react@ec60457bc)**: Popping context is O(1) in SSR (#13019) //<Dan Abramov>// - **[30bc8ef79](facebook/react@30bc8ef79)**: Allow multiple root children in test renderer traversal API (#13017) //<Dan Abramov>// - **[d480782c4](facebook/react@d480782c4)**: Don’t error when returning an empty Fragment (#12966) //<Philipp Spieß>// - **[4ac6f133a](facebook/react@4ac6f133a)**: Fallback to event.srcElement for IE9 (#12976) //<Nathan Hunzaker>// - **[23be4102d](facebook/react@23be4102d)**: Fixed an issue with nested contexts unwinding when server rendering. Issue #12984 (#12985) //<Eric Soderberg>// - **[d0d428064](facebook/react@d0d428064)**: Remove old reference to inst._wrapperState (#12987) //<Nathan Hunzaker>// - **[c78957eac](facebook/react@c78957eac)**: Fix an SVG focusing crash in IE11 (#12996) //<Jifa Jiang>// - **[bfb12ebb5](facebook/react@bfb12ebb5)**: delete a couple of redundant lines in performWorkOnRoot() in ReactFiberScheduler.js (#13003) //<Nathan Quarles>// - **[394b17eed](facebook/react@394b17eed)**: Update custom renderer docs //<Dan Abramov>// - **[188c4252a](facebook/react@188c4252a)**: Fix react-dom ReferenceError requestAnimationFrame in non-browser env (#13000) (#13001) //<Ivan Babak>// - **[9cf3733a9](facebook/react@9cf3733a9)**: update comment in computeAsyncExpiration() to reflect code (#12994) //<Nathan Quarles>// - **[c5a733e1e](facebook/react@c5a733e1e)**: Fix links of docs on the comment (#12795) //<Ende93>// - **[36546b513](facebook/react@36546b513)**: Set the correct initial value on input range (#12939) //<Maxime Nory>// - **[15767a8f8](facebook/react@15767a8f8)**: [scheduler] 5/n Error handling in scheduler (#12920) //<Flarnie Marchan>// - **[3118ed9d6](facebook/react@3118ed9d6)**: Expose unstable_interactiveUpdates on ReactDOM (#12943) //<Andrew Clark>// - **[524a74331](facebook/react@524a74331)**: Fix for Flow issues in SimpleCacheProvider (#12942) //<Flarnie Marchan>// - **[ae57b125c](facebook/react@ae57b125c)**: [simple-cache-provider] Use LRU cache eviction (#12851) //<Andrew Clark>// - **[e0a03c1b4](facebook/react@e0a03c1b4)**: Extend input type check in selection capabilities (#12062) (#12135) //<Spyros Ioakeimidis>// - **[79a740c6e](facebook/react@79a740c6e)**: Rename variables to remove references to 'global' global (#12931) //<Flarnie Marchan>// - **[ff724d3c2](facebook/react@ff724d3c2)**: [scheduler] 4/n Allow splitting out `schedule` in fb-www, prepare to fix polyfill issue internally (#12900) //<Flarnie Marchan>// - **[83f76e4db](facebook/react@83f76e4db)**: ForwardRefs supports propTypes (#12911) //<Brian Vaughn>// - **[8aeea5afa](facebook/react@8aeea5afa)**: Do not assign node.value on input creation if no change will occur (#12925) //<Nathan Hunzaker>// - **[aa85b0fd5](facebook/react@aa85b0fd5)**: Upgrade to Jest 23 (#12894) //<Simen Bekkhus>// - **[61777a78f](facebook/react@61777a78f)**: [scheduler] 3/n Use a linked list instead of map and queue for callback storage (#12893) //<Flarnie Marchan>// - **[e7bd3d59a](facebook/react@e7bd3d59a)**: No longer expose ReactNativeComponentTree (#12904) //<Sebastian Markbåge>// - **[f35d989be](facebook/react@f35d989be)**: TestRenderer warns if flushThrough is passed the wrong params (#12909) //<Brian Vaughn>// - **[557870067](facebook/react@557870067)**: Record "actual" times for all Fibers within a Profiler tree (alt) (#12910) //<Brian Vaughn>// - **[76e07071a](facebook/react@76e07071a)**: [scheduler] 2/n Adding 'schedule' fixture (#12884) //<Flarnie Marchan>// - **[345e0a71a](facebook/react@345e0a71a)**: Improve tests for 'schedule' module (#12880) //<Flarnie Marchan>// - **[8765d6089](facebook/react@8765d6089)**: Update bundle sizes for 16.4.0 release //<Andrew Clark>// - **[d427a563d](facebook/react@d427a563d)**: Updating package versions for release 16.4.0 //<Andrew Clark>// - **[53852a887](facebook/react@53852a887)**: add functional components warning about legacy context api (#12892) //<Chang Yan>// - **[fe747a51c](facebook/react@fe747a51c)**: Add React.Timeout to getComponentName (#12890) //<Toru Kobayashi>// - **[c601f7a64](facebook/react@c601f7a64)**: add siblings Timeout components test case (#12862) //<Chang Yan>// - **[735035837](facebook/react@735035837)**: add legacy context API warning in strict mode (#12849) //<Chang Yan>// - **[e88579184](facebook/react@e88579184)**: Fix a regression that caused us to listen to extra events at the top (#12878) //<Dan Abramov>// - **[7c0aca289](facebook/react@7c0aca289)**: Rollup freeze: false (#12879) //<Brian Vaughn>// - **[33289b530](facebook/react@33289b530)**: Tests and fixes for 'timing out' behavior (#12858) //<Flarnie Marchan>// - **[ad27845cc](facebook/react@ad27845cc)**: Fix double-firing submit events (#12877) //<Sophie Alpert>// - **[dd5fad296](facebook/react@dd5fad296)**: Update Flow to 0.70 (#12875) //<Dan Abramov>// - **[13003654e](facebook/react@13003654e)**: Pass "start time" and "commit time" to Profiler callback (#12852) //<Brian Vaughn>// - **[dc3b144f4](facebook/react@dc3b144f4)**: Treat Rollup "warnings" as errors (#12868) //<Dan Abramov>// - **[d7b9b4921](facebook/react@d7b9b4921)**: Fix react native example links in README of 'react-reconciler' (#12871) //<Kevin (Kun) "Kassimo" Qian>// - **[9bed4a6ae](facebook/react@9bed4a6ae)**: https in reactProdInvariant text (#12869) //<Sophie Alpert>// - **[47b003a82](facebook/react@47b003a82)**: Resolve host configs at build time (#12792) //<Dan Abramov>// Release Notes: [GENERAL] [FEATURE] [React] - React sync for revisions c0fe8d6...ae14317 Reviewed By: bvaughn Differential Revision: D8458731 fbshipit-source-id: afefaa50685d43e70c8ea85c70d2e29dee311cbb

Summary: This sync includes the following changes: - **[ae14317d6](facebook/react@ae14317d6)**: Inline fbjs/lib/emptyFunction (facebook#13054) //<Dan Abramov>// - **[72434a768](facebook/react@72434a768)**: Remove or inline some fbjs dependencies (facebook#13046) //<Dan Abramov>// - **[64c54edea](facebook/react@64c54edea)**: Adding movementX and movementY to synthenticMouseEvent fixes facebook#6723 (facebook#9018) //<Jason Williams>// - **[9bd4d1fae](facebook/react@9bd4d1fae)**: Synchronously restart when an error is thrown during async rendering (facebook#13041) //<Andrew Clark>// - **[9bda7b28f](facebook/react@9bda7b28f)**: Suspended high pri work forces lower priority work to expire early (facebook#12965) //<Andrew Clark>// - **[2e7577907](facebook/react@2e7577907)**: Fix incorrect data in compositionend event with Korean IME on IE11 (facebook#10217) (facebook#12563) //<Crux>// - **[bc963f353](facebook/react@bc963f353)**: setJSResponder in Fabric renderer (facebook#13031) //<Sebastian Markbåge>// - **[051637da6](facebook/react@051637da6)**: Extract Fabric event handlers from canonical props (facebook#13024) //<Sebastian Markbåge>// - **[2a8085980](facebook/react@2a8085980)**: Remove rAF fork (facebook#12980) //<Flarnie Marchan>// - **[e0c78344e](facebook/react@e0c78344e)**: Retry on error if there's lower priority pending work (facebook#12957) //<Andrew Clark>// - **[9725065eb](facebook/react@9725065eb)**: Update bundle sizes for 16.4.1 release //<Dan Abramov>// - **[0b87b2790](facebook/react@0b87b2790)**: Updating package versions for release 16.4.1 //<Dan Abramov>// - **[036ae3c6e](facebook/react@036ae3c6e)**: Use native event dispatching instead of Simulate or SimulateNative (facebook#13023) //<Philipp Spieß>// - **[945fc1bfc](facebook/react@945fc1bfc)**: Call gDSFP with the right state in react-test-render (facebook#13030) //<Rafał Ruciński>// - **[392530104](facebook/react@392530104)**: Remove feature flag around 'getDerivedStateFromProps' bug fix (facebook#13022) //<Flarnie Marchan>// - **[1594409fa](facebook/react@1594409fa)**: Scheduler depends on common packages (facebook#13020) //<Dan Abramov>// - **[d5c11193e](facebook/react@d5c11193e)**: Added production profiling bundle type (facebook#12886) //<Brian Vaughn>// - **[ec60457bc](facebook/react@ec60457bc)**: Popping context is O(1) in SSR (facebook#13019) //<Dan Abramov>// - **[30bc8ef79](facebook/react@30bc8ef79)**: Allow multiple root children in test renderer traversal API (facebook#13017) //<Dan Abramov>// - **[d480782c4](facebook/react@d480782c4)**: Don’t error when returning an empty Fragment (facebook#12966) //<Philipp Spieß>// - **[4ac6f133a](facebook/react@4ac6f133a)**: Fallback to event.srcElement for IE9 (facebook#12976) //<Nathan Hunzaker>// - **[23be4102d](facebook/react@23be4102d)**: Fixed an issue with nested contexts unwinding when server rendering. Issue facebook#12984 (facebook#12985) //<Eric Soderberg>// - **[d0d428064](facebook/react@d0d428064)**: Remove old reference to inst._wrapperState (facebook#12987) //<Nathan Hunzaker>// - **[c78957eac](facebook/react@c78957eac)**: Fix an SVG focusing crash in IE11 (facebook#12996) //<Jifa Jiang>// - **[bfb12ebb5](facebook/react@bfb12ebb5)**: delete a couple of redundant lines in performWorkOnRoot() in ReactFiberScheduler.js (facebook#13003) //<Nathan Quarles>// - **[394b17eed](facebook/react@394b17eed)**: Update custom renderer docs //<Dan Abramov>// - **[188c4252a](facebook/react@188c4252a)**: Fix react-dom ReferenceError requestAnimationFrame in non-browser env (facebook#13000) (facebook#13001) //<Ivan Babak>// - **[9cf3733a9](facebook/react@9cf3733a9)**: update comment in computeAsyncExpiration() to reflect code (facebook#12994) //<Nathan Quarles>// - **[c5a733e1e](facebook/react@c5a733e1e)**: Fix links of docs on the comment (facebook#12795) //<Ende93>// - **[36546b513](facebook/react@36546b513)**: Set the correct initial value on input range (facebook#12939) //<Maxime Nory>// - **[15767a8f8](facebook/react@15767a8f8)**: [scheduler] 5/n Error handling in scheduler (facebook#12920) //<Flarnie Marchan>// - **[3118ed9d6](facebook/react@3118ed9d6)**: Expose unstable_interactiveUpdates on ReactDOM (facebook#12943) //<Andrew Clark>// - **[524a74331](facebook/react@524a74331)**: Fix for Flow issues in SimpleCacheProvider (facebook#12942) //<Flarnie Marchan>// - **[ae57b125c](facebook/react@ae57b125c)**: [simple-cache-provider] Use LRU cache eviction (facebook#12851) //<Andrew Clark>// - **[e0a03c1b4](facebook/react@e0a03c1b4)**: Extend input type check in selection capabilities (facebook#12062) (facebook#12135) //<Spyros Ioakeimidis>// - **[79a740c6e](facebook/react@79a740c6e)**: Rename variables to remove references to 'global' global (facebook#12931) //<Flarnie Marchan>// - **[ff724d3c2](facebook/react@ff724d3c2)**: [scheduler] 4/n Allow splitting out `schedule` in fb-www, prepare to fix polyfill issue internally (facebook#12900) //<Flarnie Marchan>// - **[83f76e4db](facebook/react@83f76e4db)**: ForwardRefs supports propTypes (facebook#12911) //<Brian Vaughn>// - **[8aeea5afa](facebook/react@8aeea5afa)**: Do not assign node.value on input creation if no change will occur (facebook#12925) //<Nathan Hunzaker>// - **[aa85b0fd5](facebook/react@aa85b0fd5)**: Upgrade to Jest 23 (facebook#12894) //<Simen Bekkhus>// - **[61777a78f](facebook/react@61777a78f)**: [scheduler] 3/n Use a linked list instead of map and queue for callback storage (facebook#12893) //<Flarnie Marchan>// - **[e7bd3d59a](facebook/react@e7bd3d59a)**: No longer expose ReactNativeComponentTree (facebook#12904) //<Sebastian Markbåge>// - **[f35d989be](facebook/react@f35d989be)**: TestRenderer warns if flushThrough is passed the wrong params (facebook#12909) //<Brian Vaughn>// - **[557870067](facebook/react@557870067)**: Record "actual" times for all Fibers within a Profiler tree (alt) (facebook#12910) //<Brian Vaughn>// - **[76e07071a](facebook/react@76e07071a)**: [scheduler] 2/n Adding 'schedule' fixture (facebook#12884) //<Flarnie Marchan>// - **[345e0a71a](facebook/react@345e0a71a)**: Improve tests for 'schedule' module (facebook#12880) //<Flarnie Marchan>// - **[8765d6089](facebook/react@8765d6089)**: Update bundle sizes for 16.4.0 release //<Andrew Clark>// - **[d427a563d](facebook/react@d427a563d)**: Updating package versions for release 16.4.0 //<Andrew Clark>// - **[53852a887](facebook/react@53852a887)**: add functional components warning about legacy context api (facebook#12892) //<Chang Yan>// - **[fe747a51c](facebook/react@fe747a51c)**: Add React.Timeout to getComponentName (facebook#12890) //<Toru Kobayashi>// - **[c601f7a64](facebook/react@c601f7a64)**: add siblings Timeout components test case (facebook#12862) //<Chang Yan>// - **[735035837](facebook/react@735035837)**: add legacy context API warning in strict mode (facebook#12849) //<Chang Yan>// - **[e88579184](facebook/react@e88579184)**: Fix a regression that caused us to listen to extra events at the top (facebook#12878) //<Dan Abramov>// - **[7c0aca289](facebook/react@7c0aca289)**: Rollup freeze: false (facebook#12879) //<Brian Vaughn>// - **[33289b530](facebook/react@33289b530)**: Tests and fixes for 'timing out' behavior (facebook#12858) //<Flarnie Marchan>// - **[ad27845cc](facebook/react@ad27845cc)**: Fix double-firing submit events (facebook#12877) //<Sophie Alpert>// - **[dd5fad296](facebook/react@dd5fad296)**: Update Flow to 0.70 (facebook#12875) //<Dan Abramov>// - **[13003654e](facebook/react@13003654e)**: Pass "start time" and "commit time" to Profiler callback (facebook#12852) //<Brian Vaughn>// - **[dc3b144f4](facebook/react@dc3b144f4)**: Treat Rollup "warnings" as errors (facebook#12868) //<Dan Abramov>// - **[d7b9b4921](facebook/react@d7b9b4921)**: Fix react native example links in README of 'react-reconciler' (facebook#12871) //<Kevin (Kun) "Kassimo" Qian>// - **[9bed4a6ae](facebook/react@9bed4a6ae)**: https in reactProdInvariant text (facebook#12869) //<Sophie Alpert>// - **[47b003a82](facebook/react@47b003a82)**: Resolve host configs at build time (facebook#12792) //<Dan Abramov>// Release Notes: [GENERAL] [FEATURE] [React] - React sync for revisions c0fe8d6...ae14317 Reviewed By: bvaughn Differential Revision: D8458731 fbshipit-source-id: afefaa50685d43e70c8ea85c70d2e29dee311cbb

dulmandakh · 2018-08-24T10:39:27Z

closing this PR because unnecessary permissions are removed in master.

antoinerousseau · 2018-12-13T22:03:31Z

are they? then why is the app store telling me that my users might need to accept android.permission.READ_PHONE_STATE when it's not in my AndroidManifest.xml?

nc3816 · 2018-12-18T17:57:12Z

same issue as @antoinerousseau, I use the react native 0.55.0 and try to upload the APK to google play store, it says: Your APK or Android App Bundle is using permissions that require a privacy policy: (android.permission.READ_PHONE_STATE).

dulmandakh · 2018-12-18T18:01:10Z

please see http://facebook.github.io/react-native/docs/removing-default-permissions

nc3816 · 2018-12-18T18:04:54Z

@dulmandakh thank you very much!

antoinerousseau · 2018-12-19T16:47:40Z

@dulmandakh ok but then don't tell us that the permissions are removed in master.
Besides, why is that page explaining that READ_PHONE_STATE, WRITE_EXTERNAL_STORAGE, and READ_EXTERNAL_STORAGE are added for no reason? Why are they not opt-in then?

facebook-github-bot added GH Review: review-needed CLA Signed This label is managed by the Facebook bot. Authors need to sign the CLA before a PR can be reviewed. labels Mar 16, 2017

mkonicek reviewed Mar 16, 2017

View reviewed changes

mkonicek changed the title ~~Remove unneessary permissions, fixes #5886~~ Remove unnecessary permissions, fixes #5886 Mar 16, 2017

mkonicek mentioned this pull request Mar 16, 2017

Add minSdkVersion to AndroidManifest.xml facebookarchive/android-jsc#12

Merged

Remove unneessary permissions, fixes facebook#5886

b21b69a

clayallsopp force-pushed the clayallsopp-fix-permission branch from 65e5ee3 to b21b69a Compare March 16, 2017 14:57

janicduplessis reviewed Mar 18, 2017

View reviewed changes

shergin added the Android label May 31, 2017

stale bot added the Stale There has been a lack of activity on this issue and it may be closed soon. label Oct 13, 2017

stale bot closed this Oct 20, 2017

facebook-github-bot added the Failed Commands label Feb 26, 2018

hramos reopened this Feb 27, 2018

stale bot removed the Stale There has been a lack of activity on this issue and it may be closed soon. label Feb 27, 2018

hramos removed the GH Review: review-needed label Mar 8, 2018

react-native-bot added the Missing Changelog This PR appears to be missing a changelog, or they are incorrectly formatted. label Mar 16, 2018

react-native-bot added the Ran Commands One of our bots successfully processed a command. label Mar 16, 2018

janicduplessis removed the Android 🤖 label Mar 19, 2018

react-native-bot added the ✅Test Plan label May 15, 2018

dulmandakh closed this Aug 24, 2018

anshul-kai mentioned this pull request Jan 20, 2019

Why is android.permission.WRITE_EXTERNAL_STORAGE required react-native-share/react-native-share#430

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Remove unnecessary permissions, fixes #5886 #12965

Remove unnecessary permissions, fixes #5886 #12965

clayallsopp commented Mar 16, 2017

mkonicek commented Mar 16, 2017 •

edited

Loading

mkonicek Mar 16, 2017 •

edited

Loading

mkonicek Mar 16, 2017 •

edited

Loading

janicduplessis Mar 18, 2017

ferrannp Mar 22, 2017 •

edited

Loading

AndrewJack Mar 28, 2017

mkonicek Mar 16, 2017

mkonicek commented Mar 16, 2017

mkonicek commented Mar 16, 2017

clayallsopp commented Mar 16, 2017

clayallsopp commented Mar 16, 2017

janicduplessis Mar 18, 2017

clayallsopp commented Apr 11, 2017

facebook-github-bot commented Aug 11, 2017

stale bot commented Oct 13, 2017

joshfriend commented Oct 20, 2017

wprater commented Dec 29, 2017 •

edited

Loading

makovkastar commented Feb 26, 2018

facebook-github-bot commented Feb 26, 2018

praveenav commented Jun 11, 2018

praveenav commented Jun 20, 2018 •

edited

Loading

dulmandakh commented Aug 24, 2018

antoinerousseau commented Dec 13, 2018

nc3816 commented Dec 18, 2018

dulmandakh commented Dec 18, 2018

nc3816 commented Dec 18, 2018

antoinerousseau commented Dec 19, 2018

Remove unnecessary permissions, fixes #5886 #12965

Remove unnecessary permissions, fixes #5886 #12965

Conversation

clayallsopp commented Mar 16, 2017

Motivation

Test Plan

mkonicek commented Mar 16, 2017 • edited Loading

mkonicek Mar 16, 2017 • edited Loading

Choose a reason for hiding this comment

mkonicek Mar 16, 2017 • edited Loading

Choose a reason for hiding this comment

janicduplessis Mar 18, 2017

Choose a reason for hiding this comment

ferrannp Mar 22, 2017 • edited Loading

Choose a reason for hiding this comment

AndrewJack Mar 28, 2017

Choose a reason for hiding this comment

mkonicek Mar 16, 2017

Choose a reason for hiding this comment

mkonicek commented Mar 16, 2017

mkonicek commented Mar 16, 2017

clayallsopp commented Mar 16, 2017

clayallsopp commented Mar 16, 2017

janicduplessis Mar 18, 2017

Choose a reason for hiding this comment

clayallsopp commented Apr 11, 2017

facebook-github-bot commented Aug 11, 2017

stale bot commented Oct 13, 2017

joshfriend commented Oct 20, 2017

wprater commented Dec 29, 2017 • edited Loading

makovkastar commented Feb 26, 2018

facebook-github-bot commented Feb 26, 2018

praveenav commented Jun 11, 2018

praveenav commented Jun 20, 2018 • edited Loading

dulmandakh commented Aug 24, 2018

antoinerousseau commented Dec 13, 2018

nc3816 commented Dec 18, 2018

dulmandakh commented Dec 18, 2018

nc3816 commented Dec 18, 2018

antoinerousseau commented Dec 19, 2018

mkonicek commented Mar 16, 2017 •

edited

Loading

mkonicek Mar 16, 2017 •

edited

Loading

mkonicek Mar 16, 2017 •

edited

Loading

ferrannp Mar 22, 2017 •

edited

Loading

wprater commented Dec 29, 2017 •

edited

Loading

praveenav commented Jun 20, 2018 •

edited

Loading