flutter-permission-handler

flutter-permission-handler copied to clipboard

Hi, we recently got an inbox from Play Store stating that our app contains REQUEST_INSTALL_PACKAGES permission and that we have to declare this on Play Store. However, the problem is we never use it, no calls made to Permission.requestInstallPackages across our codebase.

The question is, how do I remove unused permission requests from our app? If currently not possible, is there any suggestion?

I'm having the same issue.

This is dangerous. We need to remove this permission from the library.

Same issue! Hope updated this to proceed gg play, thanks

Hi @iandis, @sdfadsfsdf, @minhnguyenandpad and @LevisLuong,

According to the error message this is because you have listed the permission in your android/app/src/main/AndroidManifest.xml. You should only put permissions you actually need in the android/app/src/main/AndroidManifest.xml file.

Can you confirm this is the case? Please remove unused permissions from AndroidManifest.xml file and submit your app again.

@mvanbeusekom <uses-permission android:name="android.permission.REQUEST_INSTALL_PACKAGES" /> Not listed in android/app/src/main/AndroidManifest.xml.

@sdfadsfsdf could you check the build/app/outputs/logs/manifest-merger-release-report.txt file? This is generated after you make a release build. This file contains all information on how the final AndroidManifest.xml is created and where permissions might came from.

If you could post the contents of this file here, I might be able to help you locate the issue.

@mvanbeusekom I'm sorry. I cannot give you that. Is there another way?

Hi @sdfadsfsdf,

It is not necessary to give it to me. This is the file providing log information on how the final AndroidManifest.xml file was constructed and where the different permissions came from.

I've done local testing myself and the mentioned permission was not listen in my final AndroidManifest.xml file, not was Google Play complaining about the REQUEST_INSTALL_PACKAGES permission. Therefore I feel these permissions are merged into your final AndroidManifest.xml by another plugin or configuration. The mentioned build/app/outputs/logs/manifest-merger-release-report.txt file will clearly state where the permission is coming from which helps you pin point the problem.

If it turns out the REQUEST_INSTALL_PACKAGES permission is coming from the permission_handler plugin after all (according to the log in the mentioned files) please let me know (a copy of the log line in question would be extremely helpful).

@mvanbeusekom I have looked up the build/app/outputs/logs/manifest-merger-release-report.txt and I found no REQUEST_INSTALL_PACKAGES in it.

@mvanbeusekom https://github.com/Baseflow/flutter-permission-handler/issues/869#issuecomment-1188331848 Same. Could not find it.

Is it possible to use ProGuard to just delete the method that calls canRequestInstallPackage?

Maybe adding something like

-assumenosideeffects class android.content.pm.PackageManager  {
  public boolean canRequestInstallPackage();
}

Hi @sdfadsfsdf,

It is not necessary to give it to me. This is the file providing log information on how the final AndroidManifest.xml file was constructed and where the different permissions came from.

I've done local testing myself and the mentioned permission was not listen in my final AndroidManifest.xml file, not was Google Play complaining about the REQUEST_INSTALL_PACKAGES permission. Therefore I feel these permissions are merged into your final AndroidManifest.xml by another plugin or configuration. The mentioned build/app/outputs/logs/manifest-merger-release-report.txt file will clearly state where the permission is coming from which helps you pin point the problem.

If it turns out the REQUEST_INSTALL_PACKAGES permission is coming from the permission_handler plugin after all (according to the log in the mentioned files) please let me know (a copy of the log line in question would be extremely helpful).

Thanks a lot! For me, it was the open_file plugin (at least I see this in logs)

The permission is coming from flutter-permission-handler, i can see some related constants in /windows/flutter/ephemeral/.plugin_symlinks/permission_handler_windows/windows/permission_constants.h

For example inline static int PERMISSION_CODE_REQUEST_INSTALL_PACKAGES = 212;

Please push a fix as soon as possible

@shareef-dweikat I am not sure what you are trying to say. The file you linked is part of the windows implementation package while the issue is about Android and Google Play Store.

The Windows code will not be compiled as part of the Android binary. Second the error message from Google clearly mentions the error is part of the Android Manifest, meaning it is registered as part of the AndroidManifest.xml file generated for the final Android binary. Note that the final AndroidManifest.xml will be different from the android/app/src/main/AndroidManifest.xml that is part of your code base as other plugins and components might register entries during compile time of the final Android app.

@mvanbeusekom Thanks. How can i find the plugin that registers this permission?

The final version of the AndroidManifest.xml is at the location mentioned here after you build your app.

How can we resolve this problem?

The notification disappeared before I knew it. Is it the same for everyone?

my problem was in the app_installer package (https://pub.dev/packages/app_installer) After I removed it, I had no more problems.

I found the permission in url launcher I think we can remove it by

<uses-permission android:name="android.permission.REQUEST_INSTALL_PACKAGES" tools:node="remove" />

https://stackoverflow.com/a/31616472

Hi @sdfadsfsdf, It is not necessary to give it to me. This is the file providing log information on how the final AndroidManifest.xml file was constructed and where the different permissions came from. I've done local testing myself and the mentioned permission was not listen in my final AndroidManifest.xml file, not was Google Play complaining about the REQUEST_INSTALL_PACKAGES permission. Therefore I feel these permissions are merged into your final AndroidManifest.xml by another plugin or configuration. The mentioned build/app/outputs/logs/manifest-merger-release-report.txt file will clearly state where the permission is coming from which helps you pin point the problem. If it turns out the REQUEST_INSTALL_PACKAGES permission is coming from the permission_handler plugin after all (according to the log in the mentioned files) please let me know (a copy of the log line in question would be extremely helpful).

Thanks a lot! For me, it was the open_file plugin (at least I see this in logs)

@AndreiMisiukevich How you solved the issue? I also get this from open_file package.

@kevit-sagar-chhapara a work around would be to explicitly let Android build system know to remove the permission using @Mohamed-Fakhry's suggestion.

Simply open up the AndroidManifest.xml file located in the android/app/src/main folder and add the following line before the <application element:

<uses-permission android:name="android.permission.REQUEST_INSTALL_PACKAGES" tools:node="remove" />

The real solution would probably be for the open_file plugin to remove the permissions from the package if it is not needed.

I will be closing this issue as it is not related to the permission_handler it self but other plugins are introducing this permission.

@kevit-sagar-chhapara a work around would be to explicitly let Android build system know to remove the permission using @Mohamed-Fakhry's suggestion.

Simply open up the AndroidManifest.xml file located in the android/app/src/main folder and add the following line before the <application element:

<uses-permission android:name="android.permission.REQUEST_INSTALL_PACKAGES" tools:node="remove" />

The real solution would probably be for the open_file plugin to remove the permissions from the package if it is not needed.

I will be closing this issue as it is not related to the permission_handler it self but other plugins are introducing this permission.

@mvanbeusekom Thanks for answering.

@kevit-sagar-chhapara honestly speaking, I realized that it was redundant package and I removed it from our bundle. But before that, I investigated that issue and found forked packages which seemed was solving the issue.

Please check it out https://pub.dev/packages/open_filex

UPD: Anyway I recommend to switch to open_filex cuz it seems open_file is abandoned.

If you have a pubsec.yaml file containing the open_file package, you may receive such a reject message from the Google Play Store.

You can use the open_file_safe package instead.

https://pub.dev/packages/open_file_safe

hi, I still got this issue.

I use this

uses-permission android:name="android.permission.REQUEST_INSTALL_PACKAGES" tools:node="remove"

still didn't work

and I am not using open_file.

can anyone help me ??

@ahmadvicky, there are two steps to take:

1. Make sure the android.permission.REQUEST_INSTALL_PACKAGES permission is not listed in the android/app/src/main/AndroidManifest.xml file.
2. When the permissions is not in the applications AndroidManifest.xml file, check the build/app/outputs/logs/manifest-merger-release-report.txt log file to find which plugin or component is adding it.

@ahmadvicky, there are two steps to take:

1. Make sure the android.permission.REQUEST_INSTALL_PACKAGES permission is not listed in the android/app/src/main/AndroidManifest.xml file.
2. When the permissions is not in the applications AndroidManifest.xml file, check the build/app/outputs/logs/manifest-merger-release-report.txt log file to find which plugin or component is adding it.

on first time build I am not include android.permission.REQUEST_INSTALL_PACKAGES at permission.

then I found this . I build with android.permission.REQUEST_INSTALL_PACKAGES tools:node="remove"

on this when I check at build/app/outputs/logs/manifest-merger-release-report.txt I found permission added.

but the problem why at first time still detected I use REQUEST_INSTALL_PACKAGES even I am not listed?

what's you think about that??

btw build.gradle

compileSdkVersion 33 minSdkVersion 24 targetSdkVersion 33

@ahmadvicky, there are two steps to take:

1. Make sure the android.permission.REQUEST_INSTALL_PACKAGES permission is not listed in the android/app/src/main/AndroidManifest.xml file.
2. When the permissions is not in the applications AndroidManifest.xml file, check the build/app/outputs/logs/manifest-merger-release-report.txt log file to find which plugin or component is adding it.

@mvanbeusekom I just checked both of these places and that permission is still no where to be found. The only place I can find that string at all is in a java file sourced from the otherwise safe open_filex package. Is Google doing a plain text search for this permission? We can't figure out why our app is still getting rejected.

@ahmadvicky, there are two steps to take:

1. Make sure the android.permission.REQUEST_INSTALL_PACKAGES permission is not listed in the android/app/src/main/AndroidManifest.xml file.
2. When the permissions is not in the applications AndroidManifest.xml file, check the build/app/outputs/logs/manifest-merger-release-report.txt log file to find which plugin or component is adding it.

@mvanbeusekom I just checked both of these places and that permission is still no where to be found. The only place I can find that string at all is in a java file sourced from the otherwise safe open_filex package. Is Google doing a plain text search for this permission? We can't figure out why our app is still getting rejected.

I am not sure about this.

but from this wanna delete but when

flutter clean flutter pub get

and get gradle again show again