Update for Google's Permission policy update

[crabbydavis]

"Only an app that has been selected as a user's default app for making calls or text messages will be able to access call logs and SMS, respectively.... SMS Intent enables you to initiate an SMS or MMS text message to share content or invitations."
If I'm understanding the documentation correctly, this plugin should no longer request for sms permissions but should create an ACTION_SEND Intent in order for us to be able to send text messages using our apps still.

[Tobiasartz]

Chiming in here. I read the announcement the same way
Here is more info about implementing the Intent:
https://developer.android.com/guide/components/intents-common#SendMessage

[dbaq]

hello @crabbydavis,

Thanks for opening this issue. I agree that we have to do something about this. Do you have time to do some testing on your side?

After reading this help page, this is what I understand:

• if sending a SMS is a core feature of your application, you need to fill the form. In this case, the developer can use options = { android: { intent: '' } };, we should request the android.Manifest.permission.SEND_SMS permission like we currently do.
• if sending a SMS is NOT a core feature, you have to use options = { android: { intent: 'INTENT' } }; (the native default SMS app), so we don't need to request the android.Manifest.permission.SEND_SMS permission because we are opening the intent.

This code https://github.com/cordova-sms/cordova-sms-plugin/blob/master/src/android/Sms.java#L51-L55 is supposed to the job (i.e. don't request the permission if INTENT). The hasPermission() method should not be called and evaluated if isIntent is true. So the issue might come from the plugin.xml file (https://github.com/cordova-sms/cordova-sms-plugin/blob/master/plugin.xml#L28)
I don't know if we still need this line and/or how we can make it optional.

If you remove the line from the plugin.xml, do you still have the warning?

[RikdeBoer]

I too got an email from Google saying that my apps currently in the Play Store must not require the SEND_SMS permission or else....

I think @dbaq is on the right track. I reckon the code is already pretty much doing what Google wants it to do. It us just unnecessarily insisting on the user having the SEND_SMS permission. It seems this is not required, when just opening the SMS dialog on the device.

Happy to help with testing -- will get back soon.

PS: is the permission READ_PHONE_STATE (from plugin.xml) required?

[dbaq]

hey @RikdeBoer, thanks for your feedback.

Can you try that and let me know please?

If you remove the line from the plugin.xml, do you still have the warning?

About that:

PS: is the permission READ_PHONE_STATE (from plugin.xml) required?

I added this permission about 4years ago and I wrote in the commit message the following: adding a new permission (READ_PHONE_STATE) in order to send multiparts messages from the current intent.

[RikdeBoer]

Thanks @dbaq

EDIT: made a mistake --the code I tested, didn't use this plugin, ignore comment below.

I've installed the above Sms.java and removed the SEND_SMS permission from the plugin.xml.
After recompilation, everything seems to still work like before.
I have tested this in the Emulator and also on an app .apk which I downloaded onto my Android 8.
Yay!
As far as I'm concerned I'd love to make the version mentioned above the new tagged release.
PS: in my manifest I have android:targetSdkVersion="26"

EDIT: made a mistake --the code I tested, didn't use this plugin.

[dbaq]

Did you also remove the READ_PHONE_STATE permission? I'd like to know if it is possible to remove both lines. (Also please read #147)

Android uses permission from manifest only below version 5.1.1, from this page

If the device is running Android 5.1.1 (API level 22) or lower, or the app's targetSdkVersion is 22 or lower while running on any version of Android, the system automatically asks the user to grant all dangerous permissions for your app at install-time

Proposition:

• Bump to next major version
• Remove the two uses-permission lines from the plugin.xml
• Edit README.md file to add a note for android developers that they will need to add those two lines in their manifest.xml if they want to target the API level 22 or lower.

Thoughts?

[RikdeBoer]

Oops.... I've just realised that the app I was testing on just uses the "SMS:" protocol to activate the SMS native dialog. So it doesn't use this plugin. The plugin is used in another app of ours, which I'm currently not working on. So I can't really comment on whether the new version of the plugin works or not. Sorry, my bad. Have adjusted my comment above.

PS: you don't want to target anything below API lvl 26, because of this: Google announcement regarding Play Store: https://developer.android.com/distribute/best-practices/develop/target-sdk

[mredbishop]

My two cents, we've submitted our exemption form as we use SMS for automating the sending of invoices and similar documents. This appears to be covered in there list of exemptions, so we should be able to continue using the SMS_SEND permission and sending without the native SMS dialog. We'll see though :o)

[dbaq]

Good for you. It sure depends on your use of the SMS.

I am still looking for someone to do some testing: #183 (comment)

[amjadyahya]

@dbaq, I'm happy to test. Tell me how.

[dbaq]

hey @amjadyahya, thanks for helping.

#183 (comment)

Can you please remove the two permissions (SEND_SMS and READ_PHONE_STATE ) from the plugin.xml file? make sure you can send SMS with intent: 'INTENT'.

[amjadyahya]

@dbaq, I have removed the two permissions (SEND_SMS and READ_PHONE_STATE ) from the plugin.xml, used intent: 'INTENT'.
It worked! but there is something that need to be addressed, Android is not behaving like iOS, sending the message on iOS or canceling it closes the messages app and returns the result (success or cancellation) back to our cordova app, but on Android it does not close the messages app and does not return back to the app until I hit Android back button, and it always returns a success even if we hit the back button before sending the message.
I hope the above helps.

[taoh75]

I did not eliminate the permissions, but I used the INTENT and we were able to send the SMS, however it should not be a long-term solution, in my case, there is no problem for the user to click on the send button. I imagine there will be some cases where we do not want that. Thanks for yours comments. Greetings from Venezuela.

[beayres]

Received a similar message on an app my company has. Curious if adding the ( android:required="false" ) to the plugin.xml file in conjunction with adding the option for "intent" will satisfy the Google Play Store or if the reference to "uses-permissions …" needs to be omitted all together to pass their new security guidelines. I tested both on a device and sending a text still functions.

[poooja2018]

Hello,
Thanks for opening this issue . Is the Google Play deadline Jan 9th for this change to be implemented in the apps ? Can someone please confirm if there is any plan to release this fix before that ?

Thanks!

[tigrannajaryan]

@dbaq thank you for looking into this. Google requires that SEND_SMS sending permission to be removed by Jan 9. Do you have an ETA when you think a fix will be available? I am happy to help with testing.

[dbaq]

hey @tigrannajaryan, thanks for your post.

• do you have a link where it says it is required by Jan 9?

• my proposition is still the same, would you like to open a PR?

[tigrannajaryan]

do you have a link where it says it is required by Jan 9?

Yes, please see https://support.google.com/googleplay/android-developer/answer/9047303

Apps that fail to meet policy requirements or submit a Permissions Declaration Form by January 9, 2019 may be removed from Google Play.

my proposition is still the same, would you like to open a PR?

Do I understand it correct that you will accept a PR which fixes this? If yes then I can have a look into it although I have never touched cordova plugins before.

[dbaq]

Thanks for the link. I am going to do it in the next hour, would love some testing right after.

[tigrannajaryan]

Thank you. I am not sure I will be able to test it before Monday, but will see what I can do.

[dbaq]

@everyone It is fixed on master, please test by pulling the latest version of the plugin:

cordova plugin add https://github.com/cordova-sms/cordova-sms-plugin.git

I'll publish the new version to npm in a few days if everything is ok.

EDIT: To test:

• sending a SMS without an INTENT
• sending a SMS with an INTENT
• publishing an app on the play store without issue.

[giladrom]

Thanks, testing now.

[tigrannajaryan]

@dbaq I tested using latest master. It works as expected:

• The app no longer requires SEND_SMS permission on Android.
• Sending with an INTENT works correctly, the built-in Messages app is opened.

I did not test without an INTENT since I do not have a corresponding path in my app. Testing publishing in Play Store will take a bit more time.

[extreg]

@everyone It is fixed on master, please test by pulling the latest version of the plugin:

cordova plugin add https://github.com/cordova-sms/cordova-sms-plugin.git

I'll publish the new version to npm in a few days if everything is ok.

EDIT: To test:

• sending a SMS without an INTENT
• sending a SMS with an INTENT
• publishing an app on the play store without issue.

I am trying to do cordova plugin add https://github.com/cordova-sms/cordova-sms-plugin.git but its giving me with following error:

0 info it worked if it ends with ok
1 verbose cli [ '/usr/local/bin/node',
1 verbose cli '/usr/local/bin/npm',
1 verbose cli 'install',
1 verbose cli 'git+https://github.com/cordova-sms/cordova-sms-plugin.git',
1 verbose cli '--production',
1 verbose cli '--save-exact' ]
2 info using [email protected]
3 info using [email protected]
4 verbose npm-session dbe824b4a4bc66f6
5 silly install loadCurrentTree
6 silly install readLocalPackageData
7 silly fetchPackageMetaData error for git+https://github.com/cordova-sms/cordova-sms-plugin.git spawn /usr/bin/git EACCES
8 timing stage:rollbackFailedOptional Completed in 1ms
9 timing stage:runTopLevelLifecycles Completed in 45568ms
10 verbose stack Error: spawn /usr/bin/git EACCES
10 verbose stack at Process.ChildProcess._handle.onexit (internal/child_process.js:229:19)
10 verbose stack at onErrorNT (internal/child_process.js:406:16)
10 verbose stack at process._tickCallback (internal/process/next_tick.js:63:19)
11 verbose cwd /Users/USERNAME/mobileapp
12 verbose Darwin 18.2.0
13 verbose argv "/usr/local/bin/node" "/usr/local/bin/npm" "install" "git+https://github.com/cordova-sms/cordova-sms-plugin.git" "--production" "--save-exact"
14 verbose node v10.7.0
15 verbose npm v6.1.0
16 error path /usr/bin/git
17 error code EACCES
18 error errno EACCES
19 error syscall spawn /usr/bin/git
20 error Error: spawn /usr/bin/git EACCES
20 error at Process.ChildProcess._handle.onexit (internal/child_process.js:229:19)
20 error at onErrorNT (internal/child_process.js:406:16)
20 error at process._tickCallback (internal/process/next_tick.js:63:19)
20 error { Error: spawn /usr/bin/git EACCES
20 error at Process.ChildProcess._handle.onexit (internal/child_process.js:229:19)
20 error at onErrorNT (internal/child_process.js:406:16)
20 error at process._tickCallback (internal/process/next_tick.js:63:19)
20 error cause:
20 error { Error: spawn /usr/bin/git EACCES
20 error at Process.ChildProcess._handle.onexit (internal/child_process.js:229:19)
20 error at onErrorNT (internal/child_process.js:406:16)
20 error at process._tickCallback (internal/process/next_tick.js:63:19)
20 error errno: 'EACCES',
20 error code: 'EACCES',
20 error syscall: 'spawn /usr/bin/git',
20 error path: '/usr/bin/git',
20 error spawnargs: [ 'rev-parse', '--revs-only', 'HEAD' ],
20 error cmd: '/usr/bin/git rev-parse --revs-only HEAD' },
20 error stack:
20 error 'Error: spawn /usr/bin/git EACCES\n at Process.ChildProcess._handle.onexit (internal/child_process.js:229:19)\n at onErrorNT (internal/child_process.js:406:16)\n at process._tickCallback (internal/process/next_tick.js:63:19)',
20 error errno: 'EACCES',
20 error code: 'EACCES',
20 error syscall: 'spawn /usr/bin/git',
20 error path: '/usr/bin/git',
20 error spawnargs: [ 'rev-parse', '--revs-only', 'HEAD' ],
20 error cmd: '/usr/bin/git rev-parse --revs-only HEAD' }
21 error The operation was rejected by your operating system.
21 error It is likely you do not have the permissions to access this file as the current user
21 error
21 error If you believe this might be a permissions issue, please double-check the
21 error permissions of the file and its containing directories, or try running
21 error the command again as root/Administrator (though this is not recommended).
22 verbose exit [ 1, true ]

any idea what is going on? it seemed to have started that when i did a remove command to remove the plugin. the command froze, i Ctrl+C to cancel it and then attempted to to an add and this error is popping up.

git works fine on other projects.

[calvinckho]

@dbaq I have also tested using latest master. It is working for me. This seems to have solved the Google Permission Restriction by switching to using INTENT.

[extreg]

never mind my previous message about the error, all good now.

@dbaq I tested on android and works as expected. back button returns back to my app.

[amjadyahya]

@dbaq, Ah, I see. Thanks.

[Marcoevich]

@dbaq it's not in the plugin.xml, but the permissions kept getting readded. I've now used this to make them go away at the cordova after_prepare hook.

For anyone else reading this: Be sure to use the correct location for the AndroidManifest.xml: platforms/android/app/src/main/AndroidManifest.xml

[MirekV]

I did all steps above (remove old cordova-sms-plugin, remove the permissions from AndroidManifest.xml, add new cordova-sms-plugin) but if I build or release my application there are still
the permissions in AndroidManifest.xml.
When I removed 2 lines of permissions from platforms/android/android.json then there are no permissions in AndroidManifest.xml anymore.
{ "xml": "<uses-permission android:name=\"android.permission.SEND_SMS\" />", "count": 1 },
{ "xml": "<uses-permission android:name=\"android.permission.READ_PHONE_STATE \" />", "count": 1 },
PS: The warning message in Google Play Console disappeared the next day.

[extreg]

I followed the steps. Confirmed nothing is showing on manifest file. Uploaded to play store, and got that same email a few days ago. I’m not sure what to do. But something tells me this is just a warning email and not representative of what the app manifest resembles. Because there is nothing about sms in the manifest.

…

Sent from my iPhone On 5 Jan 2019, at 21:53, MirekV <[email protected]<mailto:[email protected]>> wrote: I did all steps above (remove old cordova-sms-plugin, remove the permissions from AndroidManifest.xml, add new cordova-sms-plugin) but if I build or release my application there are still the permissions in AndroidManifest.xml. When I removed 2 lines of permissions from platforms/android/android.json then there are no permissions in AndroidManifest.xml anymore. { "xml": "<uses-permission android:name="android.permission.SEND_SMS" />", "count": 1 }, { "xml": "<uses-permission android:name="android.permission.READ_PHONE_STATE " />", "count": 1 }, PS: I released my app to Google Play store 2 hours ago but in Google Play Console is still the warning message about using sms permission. Do anybody know when it will disappear the warning message? Or I need to do any action like send a message to google support or something like that? Thank you. — You are receiving this because you commented. Reply to this email directly, view it on GitHub<#183 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/ARPKp10tz7AzphbqTP6kGKbtdF1vWVosks5vAK5egaJpZM4YnA4P>.

[giladrom]

The warning goes away once your updated apk goes live. Also, these permissions might be a result of another plugin. Check all of your plugin.xml files.

…

On Jan 5, 2019, at 7:35 PM, Ramy ***@***.***> wrote: I followed the steps. Confirmed nothing is showing on manifest file. Uploaded to play store, and got that same email a few days ago. I’m not sure what to do. But something tells me this is just a warning email and not representative of what the app manifest resembles. Because there is nothing about sms in the manifest. Sent from my iPhone On 5 Jan 2019, at 21:53, MirekV ***@***.******@***.***>> wrote: I did all steps above (remove old cordova-sms-plugin, remove the permissions from AndroidManifest.xml, add new cordova-sms-plugin) but if I build or release my application there are still the permissions in AndroidManifest.xml. When I removed 2 lines of permissions from platforms/android/android.json then there are no permissions in AndroidManifest.xml anymore. { "xml": "<uses-permission android:name="android.permission.SEND_SMS" />", "count": 1 }, { "xml": "<uses-permission android:name="android.permission.READ_PHONE_STATE " />", "count": 1 }, PS: I released my app to Google Play store 2 hours ago but in Google Play Console is still the warning message about using sms permission. Do anybody know when it will disappear the warning message? Or I need to do any action like send a message to google support or something like that? Thank you. — You are receiving this because you commented. Reply to this email directly, view it on GitHub<#183 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/ARPKp10tz7AzphbqTP6kGKbtdF1vWVosks5vAK5egaJpZM4YnA4P>. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#183 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AdrAoqbxEXk8e2PIU5908Qd8GoNjxhHUks5vAW8agaJpZM4YnA4P>.

[extreg]

Where was the warning message on the google play console? I tried looking the other time I didn’t find it. Maybe I missed it.

…

Sent from my iPhone On 6 Jan 2019, at 17:31, MirekV <[email protected]<mailto:[email protected]>> wrote: I did all steps above (remove old cordova-sms-plugin, remove the permissions from AndroidManifest.xml, add new cordova-sms-plugin) but if I build or release my application there are still the permissions in AndroidManifest.xml. When I removed 2 lines of permissions from platforms/android/android.json then there are no permissions in AndroidManifest.xml anymore. { "xml": "<uses-permission android:name=\"android.permission.SEND_SMS\" />", "count": 1 }, { "xml": "<uses-permission android:name=\"android.permission.READ_PHONE_STATE \" />", "count": 1 }, PS: I released my app to Google Play store 2 hours ago but in Google Play Console is still the warning message about using sms permission. Do anybody know when will it disappear the warning message? Or I need to do any action like send a message to google support or something like that? Thank you. The warning message disappeared in Google Play console today. — You are receiving this because you commented. Reply to this email directly, view it on GitHub<#183 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/ARPKpxEZXwIMpspikWZj7ylRftvaFGkIks5vAcJbgaJpZM4YnA4P>.

[rolinger]

dealing with the same stuff. I just upgraded the plugin and the SEND_SMS permission is now removed from my project:

cordova plugin remove cordova-sms-plugin
cordova clean
cordova plugin add cordova-sms-plugin.

However, @MirekV above, stated he removed both SEND_SMS and READ_PHONE_STATE....is read_phone_state required for this new google policy too? I didn't see that in my email.

[dbaq]

I am only reopening this issue so it can be easily accessible by other devs.

[pwqw]

Well, even using the latest version of cordova-android and manually targeting to the API 28 of the Android SDK (API 27 by default), it still does not work.
Of course I make sure to clean the platform directory:

cordova platform rm android
cordova platform add android@latest

So, for me, the <uses-permission android:name="android.permission.SEND_SMS" /> in the plugin.xml was necessary.

[JeffBerman]

Hi, I was wondering if anyone is having trouble getting their app approved by Google after updating to the new SMS plugin? I updated our app to use the new plugin and verified that SEND_SMS and READ_PHONE_STATE don't exist in AndroidManifest.xml and android.json. However, when adding the APK to a release the Permissions Declaration Form keeps appearing as though SEND_SMS was still specified. Also, the Google Play Console dashboard keeps saying "This app does not meet the Google Play permissions policy relating to the use of SMS or CALL_LOG".

Neither SMS or CALL_LOG are in the list of required permissions in the APK (as viewed in the Google Play Console), so I don't get why it keeps presenting that Permissions Declaration Form. I would expect that that form wouldn't appear if the APK doesn't declare SEND_SMS. It's basically forcing me to say either "my app's core function is to send SMS messages and I need special permission to do that" or else "my app is not in compliance with the new SMS policy".

If anyone has any ideas, I'd love to hear them. Thanks!

[giladrom]

It took a day or two for the warning to go away after I updated my APK. There was also one other plugin that requested these permissions for me, so double check.

…

On Feb 14, 2019, at 4:21 PM, Jeff Berman ***@***.***> wrote: Hi, I was wondering if anyone is having trouble getting their app approved by Google after updating to the new SMS plugin? I updated our app to use the new plugin and verified that SEND_SMS and READ_PHONE_STATE don't exist in AndroidManifest.xml and android.json. However, when adding the APK to a release the Permissions Declaration Form keeps appearing as though SEND_SMS was still specified. Also, the Google Play Console dashboard keeps saying "This app does not meet the Google Play permissions policy relating to the use of SMS or CALL_LOG". Neither SMS or CALL_LOG are in the list of required permissions in the APK (as viewed in the Google Play Console), so I don't get why it keeps presenting that Permissions Declaration Form. I would expect that that form wouldn't appear if the APK doesn't declare SEND_SMS. If anyone has any ideas, I'd love to hear them. Thanks! — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#183 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AdrAoue-opHrtVc4RkQcmLZm9OyOWeY-ks5vNf1-gaJpZM4YnA4P>.

[rolinger]

@JeffBerman - also check that you don't have a legacy Alpha or Beta app lingering in the other sections. I too had the same issue above and it wasn't my new app I was submitting that was the problem, it was one of the old ones I still had in the Beta Channel but was no longer using.

ALL listed versions in Alpha, Beta and Production must be compliant or you will get the error.

Removing an Alpha or Beta is not an easy process either. In most cases there is no delete or deactivate button. What I had to do is load my new production version to the Beta channel...overriding the old one causing the problem...and then promote that version to Production. It took me a few hours to figure it out - it was quite frustrating.

[JeffBerman]

@rolinger - Thanks! That's exactly what I ended up doing yesterday. So now, the Internal test track has the newest APK, and the Alpha and Beta tracks have been promoted to production. And Production has the latest APK too, of course.

But it has been 15 hours or so and on the Dashboard page in the Google Play Console (not Release management -> Release dashboard, but the top-level Dashboard) it still has the warning message.

Warning - this app does not meet Google Play permissions policy
This app does not meet the Google Play permissions policy relating to the use of SMS or CALL_LOG. You must fix this before March 9. 2019 or your app will be removed from Google Play. Note: if you have recently made a change, it can take up to 12 hours to update this message.

So maybe they're just running slow?

Oh, and the Active Artifacts page only shows my new APK; everything else has been archived.

And here are the permissions required by the APK:

15 total (15 differentiating + 0 common)
android.permission.ACCESS_COARSE_LOCATION, android.permission.ACCESS_FINE_LOCATION,
android.permission.ACCESS_NETWORK_STATE, android.permission.CAMERA,
android.permission.FLASHLIGHT, android.permission.GET_ACCOUNTS, android.permission.INTERNET,
android.permission.MODIFY_AUDIO_SETTINGS, android.permission.READ_CONTACTS,
android.permission.READ_EXTERNAL_STORAGE, android.permission.RECORD_AUDIO,
android.permission.RECORD_VIDEO, android.permission.VIBRATE, android.permission.WRITE_CONTACTS,
android.permission.WRITE_EXTERNAL_STORAGE

[rolinger]

Well...as it says Google Play. Note: if you have recently made a change, it can take up to 12 hours to update this message. - so wait a bit longer and see if it goes away. If you are able to submit the app successfully then you are good to go. If that error is preventing you from making a new Production version live, then you will prob need to contact Google directly for additional support because it sounds like you have done everything correctly.

[JeffBerman]

Looks like it just needed some time after loading every slot with the latest APK. The non-compliance warning message has gone away and stayed away for a few days now.

Thanks!

[mobileDev2020]

Hello,
I am trying to meet this Playstore requirement for our app. We build our apk using phonegap build which fetches the plugin from npm , when I built after this issue was published and released to Playstore, Google still complains we are not compatible.

We are targeting android sdk 26.

Any suggestions please?

Thanks!

[extreg]

For me it wasn’t the actual build, it was an old alpha test track I had with old build of Cordova sms that play store was flagging, they aren’t good at specifying which stream violates it. Hope it helps.

…

Sent from my iPhone On 26 Mar 2019, at 08:49, mobileDev2020 <[email protected]<mailto:[email protected]>> wrote: Hello, I am trying to meet this Playstore requirement for our app. We build our apk using phonegap build which fetches the plugin from npm , when I built after this issue was published and released to Playstore, Google still complains we are not compatible. We are targeting android sdk 26. Any suggestions please? Thanks! — You are receiving this because you commented. Reply to this email directly, view it on GitHub<#183 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/ARPKp2taHjVivtX-2f7JzHR7neeAAC4_ks5vaW6wgaJpZM4YnA4P>.

[dbaq]

Closing this one. The issue will remain pinned on the issue page.