I am trying to create a new release of my Codename One app for Android. When I upload the APK to the Google Play Console, I get an error that my APK uses android.permission.READ_PHONE_STATE and that I do need a privacy policy to be able to use that permission.
In the Codename One blog I read:
android.permission.READ_PHONE_STATE - is triggered by com.codename1.ads package, com.codename1.components.Ads, com.codename1.components.ShareButton, com.codename1.media, com.codename1.push, Display.getUdid() & Display.getMsisdn(). This permission is required for media in order to suspend audio playback when you get a phone call.
But my app does not use ads, does not use sharing, does not use media, does not use push and does not use UDID nor MSISDN. Hence, I have no clue why I would need this permission (which indeed is present in the generated APK).
How can I prevent this permission being added to the APK (or how can I detect why this permission is added).
#
#Sat Sep 28 17:12:49 BST 2019
codename1.vendor=Frans van Gool
codename1.displayName=S\u00F3 Verbos
codename1.icon=/C\:/EclipseData/JustVerbs/GaloDeBarcelos.png
codename1.arg.java.version=8
codename1.languageLevel=5
codename1.secondaryTitle=S\u00F3 Verbos
codename1.version=1.20
codename1.mainName=Main
codename1.ios.certificatePassword=
codename1.arg.ios.newStorageLocation=true
codename1.rim.signtoolDb=
libVersion=212
codename1.ios.certificate=
codename1.android.keystorePassword=**************
codename1.j2me.nativeTheme=nativej2me.res
codename1.rim.signtoolCsk=
codename1.android.keystore=/C\:/eclipseData/JustVerbs/keychain.ks
codename1.android.keystoreAlias=justverbs
codename1.rim.certificatePassword=
codename1.ios.provision=
codename1.packageName=nl.griffelservices.justverbs
Apparently this works (this text has always been here - not sure why it was hidden)
<uses-permission tools:node="remove" android:name="android.permission.READ_PHONE_STATE" />
<uses-permission tools:node="remove" android:name="android.permission.READ_PHONE_STATE" />
see:
https://facebook.github.io/react-native/docs/removing-default-permissions
(apparently this link no longer works)
I have implemented it but have not tried it (many moons later - I have tried it and it does work). I did not know one could remove permissions in the manifest - first of all I never expected they would get added!
In Android 0, apps that want the capability of installing apk's must be specifically granted that permission by the user in the system settings. However, I havent been able to figure out how to get my app into the list of apps the user can pick from.
Can anyone point me in the right direction?
Thanks
Probably this blog post will help:
https://android-developers.googleblog.com/2017/08/making-it-safer-to-get-apps-on-android-o.html
To sum it up:
Need to declare the permission in your manifest <uses-permission android:name="android.permission.REQUEST_INSTALL_PACKAGES" />
Before install you should check if the permission is still granted (PackageManager.canRequestPackageInstalls()), if not you can request it again using
Intent intent = new Intent(Settings.ACTION_MANAGE_UNKNOWN_APP_SOURCES);
intent.setData(Uri.parse("package:YOURPACKAGENAME"));
(if you came here by googling looking for a solution for this error,below links will give you an answer,also my question has kind of an explanation!)
Possible duplicate of
INSTALL_FAILED_DUPLICATE_PERMISSION… C2D_MESSAGE
Error -505 INSTALL_FAILED_DUPLICATE_PERMISSION
Wait!
I got this error today in a live project.User came with the 505 error unable to install the app.Then i ran it on IDE!
If you download an app with this mentioned issue from play store you will get an error with 505 when you try to install.
If you try to run it using your IDE you will get the error like in above image! (correct me if I am wrong)
Then I was looking for reasons.
This was my issue!
<permission
android:name="in.wptrafficanalyzer.locationroutedirectionmapv2.permission.MAPS_RECEIVE"
android:protectionLevel="signature" />
<uses-permission android:name="in.wptrafficanalyzer.locationroutedirectionmapv2.permission.MAPS_RECEIVE" />
Surprise thing was another developer's app on a particular users phone used the same signature! Damn, those copy pastes met each other today!!
I think if I try to declare same permission in two applications with
same package name this error can occur.(correct me if I am wrong)
Here are my 2 questions?
1.Do they need to be with the same permission? anyway they will get this thing when its same. lets say app A users a pkg.name with permission permission.RECEIVE app B use same package with another permission CONFIGURE_SIP.Can this occur when they meet each other?(seems like a stupid question but I want to confirm the other app that was there in the client's mobile had the same thing!)
2.What are/is there any other the possibilities that this error can occur?
An application defines a custom permission using signature level security
You attempt to update the installed app with a version signed with a different key
The test device is running Android 21 or newer with support for multiple users
Got those 1 2 3 from this post ! Are they true? If yes any good explanation about them will be great or any additional reason for this error?
There are many good answers in the mentioned posts!Not asking how to fix this! But how it gets generated! Also if I mentioned/understood something wrong please do note it down!!
Thank you.
Edit : As I mentioned please note that the issue came form an app which is already in the Play Store. And about the other app I have no idea! It's there in the client's mobile.Probably its also from play store because even developer options was not activated till I try to run on that mobile.He did not had any previous apps from my company as well.He just tried to download the app got 505 error and came to fix it.
And also my first option was the removal of that permission an it made the app install successfully(not the right thing but to confirm where the issue was). That is the reason that I need to know the possibilities of this error!
#commonsware blogs has explain it in details in Custom Permission Vulnerability and the 'L' Developer Preview:
Near as I can tell, the “L” Developer Preview requires that all apps
with a <permission> element for the same android:name value be signed
by the same signing key. The actual protectionLevel or other values
inside the <permission> does not matter. Even if they are identical, an
app trying to define the <permission> will fail to install if an
existing installed app already defines the <permission>. Specifically,
the installation of the second app will fail with an
INSTALL_FAILED_DUPLICATE_PERMISSION error.
Here the answer from #commonsware: https://stackoverflow.com/a/11730133/4758255
Your problem isn't permissions. It's impossible to have two apps with the same manifest package name.It must be unique. So system think that user try to reinstall/update old app with new signing certificate. From android developers blog
If the signing certificate changes, trying to install the new application on to the device will fail until the old version is uninstalled.
EDIT:
I run some tests with permissions. I think, behavior is very similar with application package name. Error occur only if 100% matching. Results:
app A(package test.test) vs app B(package test.test2)
package="test.test">
<permission
android:name="test2.example.h"
android:protectionLevel="signature" />
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
package="test.test2">
<permission
android:name="test.example.hr"
android:protectionLevel="signature" />
permission A - test.example.h vs B - test.example.h - DUPLICATE_PERMSSIONS error
test.example vs test.example.h - success
test.example.g vs test.example.h - success
uses-permission doesn't affect on errors/installations. But I think you can get SeciurityException in runtime, if try to use others permissions.
In manifest not added android.permission.READ_PHONE_STATE. permission.
Why error comes when I upload a new apk version error comes below.
Your app has an apk with version code 1 that requests the following permission(s): android.permission.READ_PHONE_STATE. Apps using these permissions in an APK are required to have a privacy policy set.
I have attached a screenshot of my google play store account.
my manifest file.
<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
package="com.my.package.name">
<uses-permission android:name="android.permission.INTERNET" />
<application
android:name=".utils.PreferenceManager"
android:allowBackup="true"
android:icon="#mipmap/ic_launcher"
android:label="#string/app_name"
android:largeHeap="true"
android:supportsRtl="true"
android:theme="#style/AppTheme">
<activity
android:name=".SplashScreen"
android:screenOrientation="portrait">
<intent-filter>
<action android:name="android.intent.action.MAIN" />
<category android:name="android.intent.category.LAUNCHER" />
</intent-filter>
</activity>
<activity
android:name=".MainActivity"
android:screenOrientation="portrait" />
<activity
android:name=".CategoryListActivity"
android:screenOrientation="portrait" />
<activity
android:name=".ImagesActivity"
android:screenOrientation="portrait" />
</application>
</manifest>
Your app's manifest.xml having these permission to access information from your's device but you don't have privacy policy link while submitting on the play store. so you getting this warning.
Need privacy policy for the app If your app handles personal or sensitive user data
Adding a privacy policy to your app's store listing helps provide transparency about how you treat sensitive user and device data.
Update 1
The privacy policy setting in Google Play Console has changed locations.
In Google Play Console,
Select Store presence → App content.
Under Privacy Policy.
Update 2
Select Policy → App content at the far bottom left.
Under Privacy Policy.
Just try to add this line to your manifest file:
<uses-permission android:name="android.permission.READ_PHONE_STATE" tools:node="remove" />
and add attribute xmlns:tools="http://schemas.android.com/tools" to your <manifest> tag to define namespace tools
From the documentation for tools:node="remove":
Remove this element from the merged manifest. Although it seems like you should instead just delete this element, using this is necessary when you discover an element in your merged manifest that you don't need, and it was provided by a lower-priority manifest file that's out of your control (such as an imported library).
It's third party library. You can find the culprit in build/outputs/logs/manifest-merger-release-report.txt
The dependencies you have in your project, will add their own permissions.
Please do the below to find from where "READ_PHONE_STATE" is coming.
Rebuild your android application
Press "Ctrl+Shift+F" in android studio (basically do a search all in the editor of your preference).
Search for "READ_PHONE_STATE", you would find the entry in a regenerated manifest file (not the one you originally created). By the path of it you can know, from which dependency the permission is getting added.
It may be because of any third party lib which may include that permission so from my experience in this field You have to add the privacy policy regarding to that particular information it means if you ask get accounts permission in your app than you have to declare that with your privacy policy file we use that data i.e. email address or whatever with reasons like to login in google play game.
Also can do this
<uses-permission android:name="android.permission.READ_PHONE_STATE" tools:node="remove" />
Hope This Will Guide you What You can do for this warning create privacy policy for your app and attach that with store listing.
you need to specify the min and target sdk version in the manifest file.
If not the android.permission.READ_PHONE_STATE will be added automaticly while exporting your apk file.
<uses-sdk
android:minSdkVersion="9"
android:targetSdkVersion="19" />
If you use React Native
This problem has been completely solved here
https://facebook.github.io/react-native/docs/removing-default-permissions
It can be that you need to add or update your privacy policy.
You can easily create a privacy policy using this template
https://app-privacy-policy-generator.firebaseapp.com/
Currently some people are facing the same issue because of using 12.0.0 version of AdMob lib.
Update it to 12.0.1. This should fix it. You can read more here
You need to provide a privacy policy for your app in the Google Play Console, or remove the permissions which require a privacy policy.
Go here: https://play.google.com/console/app/app-content/summary
Or open the Google Play Console for your app, scroll all the way to the bottom of the nav menu on the left and under the heading "Policy" click "App Content".
For more information on when and why the privacy policy is required, see the docs here.
If you're testing your app on a device > android 6.0 you have also to explicitely ask the user to grant the permission.
As you can see here READ_PHONE_STATE have a dangerous level.
If a permission have a dangerous level then the user have to accept or not this permission manually. You don't have the choice, you MUST do this
To do this from your activity execute the following code :
if the user use Android M and didn't grant the permission yet it will ask for it.
public static final int READ_PHONE_STATE_PERMISSION = 100;
if (Build.VERSION.SDK_INT > Build.VERSION_CODES.M && checkSelfPermission(Manifest.permission.READ_PHONE_STATE)
!= PackageManager.PERMISSION_GRANTED) {
requestPermissions(new String[]{Manifest.permission.READ_PHONE_STATE}, READ_PHONE_STATE_PERMISSION);
}
then override onRequestPermissionsResult in your activity
#Override
public void onRequestPermissionsResult(int requestCode, #NonNull String[] permissions, #NonNull int[] grantResults) {
switch (requestCode){
case READ_PHONE_STATE_PERMISSION: {
if (grantResults[0] == PackageManager.PERMISSION_GRANTED){
//Permission granted do what you want from this point
}else {
//Permission denied, manage this usecase
}
}
}
}
You should read this article to know more about it
Probably you're using PlayServices of version 9.6.0. Then you should update it, it's library's bug. More info here.
OR
Add
<uses-permission
android:name="android.permission.READ_PHONE_STATE"
tools:node="remove" />
to your manifest file.
Are you using AdSense or other ads in your app, or maybe Google Analytics ? I think if you do so, even if you don't have the android.permission.READ_PHONE_STATE in your manifest this is added by the ads library.
There are free templates that might help you create a privacy policy.
This is the email i received from Google about it :
Hello Google Play Developer, Our records show that your app, xxx, with
package name xxx, currently violates our User Data policy regarding
Personal and Sensitive Information. Policy issue: Google Play requires
developers to provide a valid privacy policy when the app requests or
handles sensitive user or device information. Your app requests
sensitive permissions (e.g. camera, microphone, accounts, contacts, or
phone) or user data, but does not include a valid privacy policy.
Action required: Include a link to a valid privacy policy on your
app's Store Listing page and within your app. You can find more
information in our help center. Alternatively, you may opt-out of this
requirement by removing any requests for sensitive permissions or user
data. If you have additional apps in your catalog, please make sure
they are compliant with our Prominent Disclosure requirements. Please
resolve this issue by March 15, 2017, or administrative action will be
taken to limit the visibility of your app, up to and including removal
from the Play Store. Thanks for helping us provide a clear and
transparent experience for Google Play users. Regards, The Google Play
Team
You should drop android.permission.READ_PHONE_STATE permission. Add this to your manifest file:
<uses-permission
android:name="android.permission.READ_PHONE_STATE"
tools:node="remove" />
1.You need to create privacy policy page on your website and update your privacy policy for the permissions you are asking.
2.Update new SDK remove unwanted permissions and resubmit the app.
I found this free website that will make for you the policy AND host it:
https://www.freeprivacypolicy.com/
Then add it to the play store under Store Listing - at the bottom add the public link for the policy that you got from https://www.freeprivacypolicy.com/
I solved this problem by this way:
Google play console
find App content-> Privacy policy
and then
Privacy policy URL set to
you can submit your page.
2018 update:
For AdMob users, this causes AdMob version 12.0.0 (currently last version). It wrongly requests READ_PHONE_STATE permission, so even if your app doesn't require READ_PHONE_STATE permission in manifest, you won't be able to update your app in the Google Play Console (it will tell you to create a privacy policy page for your app, because your app requires this permission).
See this: https://developers.google.com/android/guides/releases#march_20_2018_-_version_1200
Also, they wrote they will publish an update to 12.0.1 fixing this soon.
I was facing same issue and got the error while uploading apk to Google play.
I used ads in my app, and I was not even mentioned READ_PHONE_STATE permission in my manifest file. but yet I got this error. Then I change dependencies for ads in build.gradle file. and then it solved my issue. They solved this issue in 12.0.1.
compile 'com.google.android.gms:play-services-ads:12.0.1'
See steb by step and you will understood
public static String getVideoTitle(String youtubeVideoUrl) {
Log.e(youtubeVideoUrl.toString() + " In GetVideoTitle Menu".toString() ,"hiii" );
try {
if (youtubeVideoUrl != null) {
URL embededURL = new URL("https://www.youtube.com/oembed?url=" +
youtubeVideoUrl + "&format=json"
);
Log.e(youtubeVideoUrl.toString() + " In EmbedJson Try Function ".toString() ,"hiii" );
Log.e(embededURL.toString() + " In EmbedJson Retrn value ".toString() ,"hiii" );
Log.e(new JSONObject(IOUtils.toString(embededURL)).getString("provider_name").toString() + " In EmbedJson Retrn value ".toString() ,"hiii" );
return new JSONObject(IOUtils.toString(embededURL)).getString("provider_name").toString();
}
} catch (Exception e) {
Log.e(" In catch Function ".toString() ,"hiii" );
e.printStackTrace();
}
return null;
}
If you are using the package device_id to get the unique device id then that will add an android.permission.READ_PHONE_STATE without your knowledge which eventually will lead to the Play Store warning.
Instead you can use the device_info package for the same purpose without the need of the extra permission. Check this SO thread
I could not release my app on Google as error show after uploading app apk file on Google testing "internal testing release."
Attached screen shot please resolve advise how to resolve this error.
App generated on Mobiroller app generator.
Even though after I have [Error massage seen: "Your APK or Android App Bundle is using permissions that require a privacy policy: (android.permission.CAMERA)."
1added privacy policy in Mobiroller in my app.
Error massage seen: "Your APK or Android App Bundle is using permissions that require a privacy policy: (android.permission.CAMERA)."
I'm working with some sample code here:
http://code.google.com/p/google-api-java-client/source/browse/picasa-android-sample/src/main/java/com/google/api/services/samples/picasa/android/PicasaSample.java?repo=samples
I authorized access in my Android app, but I cannot find where to now revoke access, so I can run through it again. Uninstalling the APK does not seem to reset any permissions.
I believe if you go to https://accounts.google.com/IssuedAuthSubTokens it should list your application under "Connected Sites, Apps and Services" from there you can revoke access.
Two steps to trigger the authorization page again:
go to https://accounts.google.com/IssuedAuthSubTokens to revoke the app you want. This will clear the permissions from server side.
go to your android device's settings->Data and time: fast-forward your time by a day or two. This will force the current token to expire.
It's not possible via any public, official API.
See:
https://groups.google.com/forum/?fromgroups=#!topic/android-developers/gOVZ0DF7ccg
http://grokbase.com/t/gg/android-developers/121j6ypxkb/revoke-permissions-to-access-google-accounts
Even uninstalling and re-installing the app doesn't help.
This might be the way on a rooted device:
How do you force AccountManager to show the "Access Request" screen after a user has already allowed access?
You need to programmatically revoke the token. First, try out the example app posted at:
https://developers.google.com/drive/quickstart-android
This example app displays the dialog to let you pick an account, then takes a photo and then uploads it to Google Drive. One important thing I discovered is that this sample app will eventually fail. I discovered that the camera portion of the app causes crashes. So disable the camera part of the code and just replace the file with some file on an SD card and upload the file to Drive instead.
To revoke the permission to use Drive, you need to execute the following code:
String token = credential.getToken();
HttpRequestFactory factory = HTTP_TRANSPORT.createRequestFactory();
GoogleUrl url = new GoogleUrl("https://accounts.google.com/o/oauth2/revoke?token=" + token);
HttpRequest request = factory.buildGetRequest(url);
HttpResponse response = request.execute();
Refer to the sample code on how to access the credential variable. Also, you must run the above code in a thread that is not on the main thread or it will fail.
You also need to add the following permissions. The sample code fails to indicate these permissions and without them the app will crash:
<uses-permission android:name="android.permission.ACCOUNT_MANAGER" />
<uses-permission android:name="android.permission.GET_ACCOUNTS" />
<uses-permission android:name="android.permission.USE_CREDENTIALS" />
<uses-permission android:name="android.permission.MANAGE_ACCOUNTS" />
If Eclipse complains that some of those permissions are only granted to the system, just run Clean Project and it will remove the warning. After you have done this, you should uninstall the app and reboot the device. For more information about revoking tokens, see the section "Revoking a Token" at:
https://developers.google.com/accounts/docs/OAuth2WebServer
After struggling to revoke authorisation for Gmail API permissions granted on my Android app (still in debug), I worked out that it does appear on https://security.google.com/settings/security/permissions like #David Waters mentions (it's a new link but goes to the same place) but only if you've properly enabled the API via the Google Developers Console. This means properly adding your OAuth 2.0 client ID, even if the app is still in development and in Debug Mode.
There's a very good guide on how to add your credentials on the Android Quickstart guide on the Gmail API site (Steps 1 & 2).
Using Google Play Services:
http://developer.android.com/reference/com/google/android/gms/auth/GoogleAuthUtil.html
Add https://www.googleapis.com/auth/userinfo.profile to your scope.
Example:
String scope="oauth2:https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/userinfo.profile"
final String token = GoogleAuthUtil.getToken(context, "xxxx#gmail.com", scope);
OR "brute force"
Intent res = new Intent();
res.addCategory("account:xxxx#gmail.com");
res.addCategory("scope:oauth2:https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/userinfo.profile");
res.putExtra("service", "oauth2:https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/userinfo.profile");
Bundle extra= new Bundle();
extra.putString("androidPackageName","com.your.package");
res.putExtra("callerExtras",extra);
res.putExtra("androidPackageName","com.your.package");
res.putExtra("authAccount","xxxx#gmail.com");
String mPackage = "com.google.android.gms";
String mClass = "com.google.android.gms.auth.TokenActivity";
res.setComponent(new ComponentName(mPackage,mClass));
startActivityForResult(res,100);
Now, when you revoke the access here https://accounts.google.com/IssuedAuthSubTokens the application shows you the window for permission again in the device.
You can revoke account permissons on ...
https://security.google.com/settings/security/permissions
You can get there by [Account Settings] > [Account Permissions]
Proof that this answer is the real deal:
Look into your AndroidManifest file.