Vue-devtools: browsing history

[jpkontreras]

hello
devtools now is asking for permission for browsing history
Can you elaborate why you need this?

Thanks

[Akryum]

Here are the permissions asked by the extension. We need to access all website in order to detect any Vue app. Not sure why you get asked browsing history though. Is it on Chrome or Firefox?

[jpkontreras]

Chrome . win10 . Its in spanish

[revolter]

Me too.

[willnode]

Looking at manifest.json there's new permissions tabs and contextMenus in 4.0.0. Not sure what are they.

[serkanyersen]

here is the warning in English.

[Exitialis]

I have the same question

[Genteure]

The version in manifest.json file on master branch is 3.1.7
The online version (from Chrome Web Store) is 4.0.0

[Rundik]

@Genteure

[a-eid]

I just got that request as well, I was about to create an issue!!

[Genteure]

@Rundik I'm confused.
b3f217d is tagged v4.0.0 and is the newest commit on the branch master according to releases page
and meanwhile master's newest commit is 24812e5

[Svenskunganka]

@Genteure GitHub Releases are based on Git Tags, and you can see commit b3f217d is the latest for the v4.0.0 tag, among some other commits (test fixes and build). Evan probably forgot or hasn't had the time yet to push those commits to the master branch, and instead have them locally, which he created a local tag from, then pushed it to GitHub and lastly created a release out of. Does that make sense? 😄

edit: This also means that the lines in manifest.json @Akryum initially linked to is not up to date with the actual release v4.0.0. The manifest.json that the release is based on can be viewed here, and it has an additional premission request tabs, which might be the cause of this.

edit2: Looks like the tabs permission is what's prompting for it. See https://bugs.chromium.org/p/chromium/issues/detail?id=429185

I don't think the tabs permission is needed. The only place I can see that vue-devtools is using chrome.tabs is here and here, which are chrome.tabs.executeScript and chrome.tabs.onActivated.addListener. According to the docs, they shouldn't need the tabs permission.

[crimx]

Will there be a hot fix for this?

[dmmikkel]

I hope this can be resolved quickly. I can not acccept vue devtools accessing my browser history and I really need the devtools for work.

[errozero]

I have also received this notification today asking for permission to access browser history.

[byCedric]

I've disabled it too until this can be resolved. It's a no-go for me and the company I work for to allow a development tool to read my browsing history. If I can help with anything I would be glad to help!

[Akryum]

Sorry folks, it seems the permission wasn't necessary and it has been removed now. We will push a new release asap! 😉

Changes: https://github.com/vuejs/vue-devtools/pull/500/commits/7fc1a477cd110dd708854ec744ed852ac2e01796

[DeanMW]

Ohh thats awkward. Thanks for the quick response 👍

[martinbean]

Subscribing to this thread. Could it be updated when this has been fixed? As not really willing to give unnecessary permissions to a Chrome extension.

[jackbarham]

Delete the extension from Chrome then reinstall it from the Chrome Store.

[jeremyjh]

Evan probably forgot or hasn't had the time yet to push those commits to the master branch, and instead have them locally, which he created a local tag from, then pushed it to GitHub and lastly created a release out of.

This is not an acceptable development practice for a tool of this nature. For adequate security and transparency we need the source to every release to be tagged and available in Github before it is deployed to the Chrome Store. Otherwise we do not even know the legitimate maintainers of this tool are still in control of it on the store.

[martinbean]

Delete the extension from Chrome then reinstall it from the Chrome Store.

@jackbarham Cool, didn’t know the fix had already been pushed/was available. Thanks!

[Akryum]

The update 4.0.1 is live with the removed permission.

[Svenskunganka]

@jeremyjh I think you've misunderstood me, the full source and commit history of the release was always available on GitHub, just not under the master branch, but rather under the v4.0.0 tag.