Android: Android Permissions

[gryphius2]

Actual behaviour

-Nextcloud App requests android.permission.READ_PHONE_STATE

Expected behaviour

-Nextcloud App does not request android.permission.READ_PHONE_STATE

Steps to reproduce

1. Install Nextcloud App 1.4.0 from f-droid store

Environment data

Android version: 4.2.2

Stock or customized system: custom

Nextcloud app version: 1.4.0

Since version 1.4.0 Nextcloud requires android.permission. READ_PHONE_STATE, which I believe should not needed for the correct function of the App. I think this permission is quite sensitive as it allows access to information uniquely identifying the user. I would like to request removal of this permission or at the very least an explanation why it is needed and how it is used.

[aronovgj]

The reasons why permissions are used by the app should always be explained in the description in the store.

https://play.google.com/store/apps/details?id=dk.tacit.android.foldersync.full
This apps description is exemplary. At the end of the description all the permissions are listed.

[FriendFX]

@aronovgj could you explain why the Play Store link in your message is different from the one of this app, which according to this GitHub project's main page is
https://play.google.com/store/apps/details?id=com.nextcloud.client

Which, by the way, does not list the reasons for why this permission is used.

[aronovgj]

That was the point. To show an app (which is obviously not Nextcloud) as an example of how it is supposed to be.

[tobiasKaminsky]

I will have a look why this is necessary.

[tobiasKaminsky]

@gryphius2 thank you for pointing this out.
It seems indeed not to be necessary.

[gryphius2]

@tobiasKaminsky thanks for looking into this

[AndyScherzinger]

I'd say we postpone this (maybe for a 1.4.2) until we have some feedback (https://github.com/nextcloud/android/pull/523#issuecomment-274196716) from @przybylski

[przybylski]

I'll have a look later today :)

[przybylski]

Ok I remember now, I was playing around with contacts synchronization and some feature required this. It is not needed for data storage. Sorry for putting that there :)

It can be removed

[AndyScherzinger]

@gryphius2 scheduled for 1.4.2