Android Question Critical Permissions - android.permission.RECEIVE_SMS

Marcos Alves · Feb 2, 2019

Hello all,

I have a problem here... as most of you must to know, Google recently decided that it's dangerous to allow apps to access Call Log and SMS (for me, it's much more dangerous to give access to camera and microphone, for example... but, who knows?).
One of my apps is using sms to authenticate the phone number and intent in order to automatize the reception of the code. As B4A don't have yet a lib to the SMS Retriever API (recommend by Google as alternative method), I removed all SMS authorization from manifest and the run time permissions for SMS also, but Google is still identifying the request somewhere in my app when I try to publish. Why? I understand that the permissions list is in the manifest no? Is there any library adding this permission request when I compile the app?
I think that this is a very important subject matter because many of apps could be banned from google play due this problem...

This is my Manifest (notice the comment in SMS lines):

B4X:

'This code will be applied to the manifest file during compilation.
'You do not need to modify it in most cases.
'See this link for for more information: https://www.b4x.com/forum/showthread.php?p=78136

SetApplicationAttribute(android:largeHeap,"true")
AddManifestText(
<uses-sdk android:minSdkVersion="10" android:targetSdkVersion="26"/>
<supports-screens android:largeScreens="true"
    android:normalScreens="true"
    android:smallScreens="true"
    android:anyDensity="true"/>)
SetApplicationAttribute(android:icon, "@drawable/icon")
SetApplicationAttribute(android:label, "$LABEL$")
'AddPermission(android.permission.RECEIVE_SMS)
'AddReceiverText(smsdetect,
'<intent-filter>
'    <action android:name="android.provider.Telephony.SMS_RECEIVED" />
'</intent-filter>)

AddPermission(android.permission.ACCESS_FINE_LOCATION)
AddPermission("android.permission.READ_CONTACTS")
AddPermission("android.permission.WRITE_CONTACTS") 'if write access is required
AddPermission("android.permission.READ_EXTERNAL_STORAGE")
AddPermission("android.permission.WRITE_EXTERNAL_STORAGE")
'End of default text.

'### Conference
AddPermission(android.permission.CAMERA)
AddPermission(android.permission.RECORD_AUDIO)
AddPermission(android.permission.MODIFY_AUDIO_SETTINGS)

'### Theme fix
CreateResourceFromFile(Macro, Themes.DarkTheme) 'or Themes.LightTheme

'### Counter on ShortCut (Badge)
'# Samsung
AddPermission(com.sec.android.provider.badge.permission.READ)
AddPermission(com.sec.android.provider.badge.permission.WRITE)
'## HTC
AddPermission(com.htc.launcher.permission.READ_SETTINGS)
AddPermission(com.htc.launcher.permission.UPDATE_SHORTCUT)
'## Sony
AddPermission(com.sonyericsson.home.permission.BROADCAST_BADGE)
'### Apex
AddPermission(com.anddoes.launcher.permission.UPDATE_COUNT)
'## Solid
AddPermission(com.majeur.launcher.permission.UPDATE_BADGE)
'## Huawei
AddPermission(com.huawei.android.launcher.permission.CHANGE_BADGE)
AddPermission(com.huawei.android.launcher.permission.READ_SETTINGS)
AddPermission(com.huawei.android.launcher.permission.WRITE_SETTINGS)

AddApplicationText(
  <provider
  android:name="android.support.v4.content.FileProvider"
  android:authorities="$PACKAGE$.provider"
  android:exported="false"
  android:grantUriPermissions="true">
  <meta-data
  android:name="android.support.FILE_PROVIDER_PATHS"
  android:resource="@xml/provider_paths"/>
  </provider>
)
CreateResource(xml, provider_paths,
   <external-files-path name="name" path="shared" />
)

'CreateResource(xml, provider_paths,
'   <external-files-path name="name" path="notification" />
')

AddActivityText(Chats,
<intent-filter>
<action android:name="android.intent.action.SEND" />
<category android:name="android.intent.category.DEFAULT" />
<data android:mimeType="text/plain" />
<data android:mimeType="image/*" />
<data android:mimeType="audio/*" />
</intent-filter>)

AddApplicationText(
<meta-data android:name="AbtoVoipAuthority" android:value="com.comten.nexphone.db" />
<provider
android:name="org.abtollc.db.DBProvider"
android:authorities="com.comten.nexphone.db"
android:exported="false" />
)

AddApplicationText(
<meta-data android:name="AbtoVoipAuthrority"
    android:value="com.comten.nexphone.db" />)

AddManifestText(
<uses-feature android:name="android.hardware.wifi"
    android:required="false"/>)
AddManifestText(
<uses-feature android:name="android.hardware.microphone"
    android:required="true"/>)
AddManifestText(<uses-feature android:name="android.hardware.audio.output"     android:required="true"/>)
'AddManifestText(<uses-feature android:name="android.hardware.audio.pro"     android:required="true"/>)
AddManifestText(
<uses-feature android:name="android.hardware.touchscreen"
    android:required="false"/>)
AddManifestText(
<uses-feature android:name="android.hardware.bluetooth"
    android:required="false"/>)
AddManifestText(
<uses-feature android:name="android.hardware.portrait"
    android:required="false"/>)
AddManifestText(
<uses-feature android:name="android.hardware.camera"
    android:required="false"/>)
AddManifestText(
<uses-feature android:name="android.hardware.camera.autofucs"
    android:required="false"/>)
AddManifestText(
<uses-feature android:name="android.hardware.camera.flash"
    android:required="false"/>)
AddManifestText(
<uses-feature android:name="android.hardware.camera.front"
    android:required="false"/>)

SetActivityAttribute(image_edit, android:windowSoftInputMode, adjustPan|stateHidden)
SetActivityAttribute(profile, android:windowSoftInputMode, adjustPan|stateHidden)
SetActivityAttribute(place_add, android:windowSoftInputMode, adjustPan|stateHidden)
'SetActivityAttribute(chat, android:windowSoftInputMode, adjustPan|stateHidden)
SetActivityAttribute(showimage, android:screenOrientation, "unspecified")


AddPermission(android.permission.INTERNET)
AddPermission(android.permission.ACCESS_WIFI_STATE)
AddPermission(android.permission.ACCESS_NETWORK_STATE)
AddPermission(android.permission.READ_PHONE_STATE)
AddPermission(android.permission.WAKE_LOCK)
AddPermission(android.permission.DISABLE_KEYGUARD)
AddPermission(android.permission.VIBRATE)
AddPermission(android.permission.USE_SIP)
AddPermission(android.permission.CONFIGURE_SIP)
AddPermission(android.permission.READ_CONTACTS)
AddPermission(android.permission.WRITE_CONTACTS)
AddPermission(android.permission.READ_PROFILE)
AddPermission(android.permission.READ_EXTERNAL_STORAGE)
AddPermission(android.permission.WRITE_EXTERNAL_STORAGE)
AddPermission(android.permission.BROADCAST_STICKY)
AddPermission(android.permission.MODIFY_AUDIO_SETTINGS)
AddPermission(org.abtollc.db.permRead)


AddManifestText(<uses-feature android:name="android.hardware.location.gps"/>)

SetApplicationAttribute(android:name, "org.abtollc.sdk.AbtoApplication")

AddApplicationText(
<service
    android:name="org.abtollc.service.ABTOSipService"
    android:exported="true">
    <intent-filter>
        <action android:name="org.abtollc.service.ABTOSipService" />
        <action android:name="org.abtollc.service.SipConfiguration" />
    </intent-filter>
</service>)

CreateResourceFromFile(Macro, FirebaseAnalytics.GooglePlayBase)
CreateResourceFromFile(Macro, FirebaseAnalytics.Firebase)
CreateResourceFromFile(Macro, FirebaseNotifications.FirebaseNotifications)
'CreateResourceFromFile(Macro, FirebaseAnalytics.FirebaseAnalytics)
'CreateResourceFromFile(Macro, FirebaseAuth.FirebaseAuth)

CreateResourceFromFile("google-services", "google-services.json")

'************ Google Play Services Base ************
AddApplicationText(
   <activity android:name="com.google.android.gms.common.api.GoogleApiActivity"
  android:theme="@android:style/Theme.Translucent.NoTitleBar"
  android:exported="false"/>
    <meta-data
  android:name="com.google.android.gms.version"
  android:value="@integer/google_play_services_version" />
)
'************ Google Play Services Base (end) ************

DonManfred · Feb 2, 2019

Marcos Alves said:
As B4A don't have yet a lib to the SMS Retriever API (recommend by Google as alternative method)

should not be difficult to write one. As far as i know there is not much needed.
Plus a setting in manifest for the broadcast and setting up a briadcastreceiver.

DonManfred · Feb 2, 2019

Marcos Alves said:
Is there any library adding this permission request when I compile the app?

click the list permissions button in the log tab

Marcos Alves · Feb 2, 2019

DonManfred said:
click the list permissions button in the log tab

Ok, I can see SEND_SMS BUT it's not in the manifest... I don't need this permission... how can I remove?

DonManfred · Feb 2, 2019

Marcos Alves said:
it's not in the manifest

but you are using PhoneSMS it seems. The library adds the permission. Remove the library.

But you are now asking another question

Marcos Alves · Feb 2, 2019

DonManfred said:
click the list permissions button in the log tab

It looks that it's generated by phone library, which could be a problem because I use many methods of phone to know the Android Version and serial... I done a workaround to publish:

Compiled...
Edited the AndroidManifest.xml file removing <uses-permission android:name="android.permission.SEND_SMS"/>
Marked this file as read-only in windows
Cleaned the compilation
Compile again

As I don't call SMS methods of the phone lib, I'll not get any error... but it's really a poor workaround no?

Marcos Alves · Feb 2, 2019

DonManfred said:
but you are using PhoneSMS it seems. The library adds the permission. Remove the library.

But you are now asking another question

I cant' remove phone lib... I use methods to check Android version, volume level and others... but no SMS.

Marcos Alves · Feb 2, 2019

Marcos Alves said:
It looks that it's generated by phone library, which could be a problem because I use many methods of phone to know the Android Version and serial... I done a workaround to publish:

Compiled...

Edited the AndroidManifest.xml file removing <uses-permission android:name="android.permission.SEND_SMS"/>

Marked this file as read-only in windows

Cleaned the compilation

Compile again

As I don't call SMS methods of the phone lib, I'll not get any error... but it's really a poor workaround no?

@DonManfred ... this solution works fine... but, do you know any other?

DonManfred · Feb 2, 2019

Have you tried to use

B4X:

RemovePermission("android.permission.SEND_SMS")

in the manifest?

Marcos Alves · Feb 2, 2019

DonManfred said:
Have you tried to use

B4X:

RemovePermission("android.permission.SEND_SMS")

in the manifest?

No, I didn't. What will be the result? The compiler will find remove and don't add in XML?

DonManfred · Feb 2, 2019

Dont ask a question if you just CAN TRY it... I am not a hotline.

Marcos Alves · Feb 2, 2019

DonManfred said:
Dont ask a question if you just CAN TRY it... I am not a hotline.

[/QUOTE
Sorry @DonManfred , while you answered I was already trying. It wasn't really a question but more a rhetoric answer by me . I'll be a little bit more careful with this.
So, direct to the point: worked... the SMS was removed from manifest xml! Really thanks @DonManfred . Your support makes a great difference in this community !

DonManfred · Feb 2, 2019

Do you have an api which could send a sms to my device after i requested it with a httpcall for ex?

i need to get a SMS in a specific format with a specific signature... I found an online site where i can send a sms but the captcha i boring and it does not provide copy and paste so i need to enter the sms manually...

Reason is that i wrote a wrapper for the SMS Retriever api and need to test it now

Erel · Feb 3, 2019

Marcos Alves said:
but it's really a poor workaround no?

Yes.

1. The Phone library will not add the SMS permission. Only when you dim a PhoneSms object will the permission added. Search your code for PhoneSms.

2. Use RemovePermission to remove a permission.

Marcos Alves · Feb 4, 2019

Erel said:
Yes.

1. The Phone library will not add the SMS permission. Only when you dim a PhoneSms object will the permission added. Search your code for PhoneSms.

2. Use RemovePermission to remove a permission.

Thanks @Erel . I'll search for the "Dim PhoneSMS"

Marcos Alves · Feb 4, 2019

DonManfred said:
Do you have an api which could send a sms to my device after i requested it with a httpcall for ex?

i need to get a SMS in a specific format with a specific signature... I found an online site where i can send a sms but the captcha i boring and it does not provide copy and paste so i need to enter the sms manually...

Reason is that i wrote a wrapper for the SMS Retriever api and need to test it now

Hello @DonManfred . Yes, we have an internal api to send SMS messages. Besides we have our own SMS servers, we also parse external service providers with their own API's... A SMS service that I recommend today is Nexmo ( www.nexmo.com ) . You can do a small refill with PayPal and can test with their API directly...
By the way, I can send a payment to collaborate with your SMS Retrieve wrapper... give me your PayPal address

Regards.

DonManfred · Feb 4, 2019

Marcos Alves said:
give me your PayPal address

you can find a donate button in my signature

Marcos Alves · Feb 4, 2019

DonManfred said:
you can find a donate button in my signature

donation done. I hope that other developers do the same. The valuation of our job is very important to be able to continue.

DonManfred · Feb 4, 2019

Marcos Alves said:
I hope that other developers do the same

not only you ;-) I already spent around 10 hours to get it working

Thank you for your donation! Really appreciated!

Marcos Alves · Feb 4, 2019

DonManfred said:
not only you ;-) I already spent around 10 hours to get it working

Thank you for your donation! Really appreciated!

You're welcome! Only a small donation, but also a hope that I can incentive this behavior to support innovative and dedicated developers like you.

Android Question Critical Permissions - android.permission.RECEIVE_SMS

Well-Known Member

Expert

Expert

Well-Known Member

Expert

Well-Known Member

Well-Known Member

Well-Known Member

Expert

Well-Known Member

Expert

Well-Known Member

Expert

B4X founder

Well-Known Member

Well-Known Member

Expert

Well-Known Member

Expert

Well-Known Member

Privacy & Transparency

Privacy & Transparency