Testing the next release of MIT App Inventor (nb187)

When we talk about permissions, we basically mean dangerous permissions. Not dangerous permissions (like Internet etc.) are always declared and granted. As of API 23 (Android 6), the user does not notice that Internet permission etc. has been granted. These "not dangerous" permissions are only displayed on devices with an API < 23, since all permissions there are granted at install-time.

At DefaultFileScope, we're only talking about READ / WRITE permissions. And as I said several times, it should be possible to request READ permission on all Android versions (i.e. on Android 10+). WRITE permission only up to Android 9.

A positive note:
I was able to copy an audio file from the assets into the privateDir (with the File component) and play it from there with the Player component (of course without READ / WRITE permissions). Therefore it should also be possible to first download (audio) files to the ASD, then move them to the privateDir (copy / delete) and play them from there.

This could circumvent the problem of the AIA limitation to 30 MB and thus save sensitive files in the internal storage, which users would only have access to with a rooted device.

Note: I haven't found a way to decompile an AAB yet. This would be very helpful for adding (large, many) assets later ... as has been possible with the APK so far (see here).

Unless I have missed the discussion somewhere, webviewer cannot read / access files in media/storage on Android 11 device - specifically the /Download folder. Webviewer returns net::ERR_ACCESS_DENIED. Tested with companion and compiled from the test server.

Does one need to set a scope ?

On Android 11 you can only access / read media files.

See also here:

if I understand it correctly, then theoretically it would be possible to use the Storage Access Framework to access documents and other files... see also here

https://community.appinventor.mit.edu/t/file-component-is-showing-its-age/24751/5?u=taifun

Taifun

I do not see an issue using mp3 files which are stored in a subfolder of /Music. These are read only and work fine in my AI2 mp3 player app. I also understood that "other" files could be stored in Documents or Downloads and that these too would be read only for apps...

just to clarify what @Anke was trying to say... so according to the link, @Anke provided here Testing the next release of MIT App Inventor (nb187) - #149 by Anke which links to Android 11 Scoped Storage - Saving Files To Shared Storage | Android Explained we can find the following Q&A:

Q: I can put non-media files into other folders, such as Downloads, without any permission. Is this a bug?

A: No. Apps may contribute files to these collections, and the use of both Downloads and Documents collections for non-media files is a best practice. However, keep in mind that only the app that created the files can access them by default.

which means, the webviewer can or should be able to read/access files in the /Downloads folder, but only if the app created those files... but it should be /Downloads and not /Download ... maybe you can test that again @TIMAI2...

Taifun

1 Like

This where it gets interesting...I only have a physical Download folder. This does, however, show up in the "media" folder Downloads when I use the "Files" app. I can see the files I placed...

I have a Downloads category in my Files app but when i click it I go to the physical Download folder.

Try these two APKs:


The first was created on the AI2 build server (targetSdk = 29).
The second on the AI2 test server (targetSdk = 30).

Steps:

  1. First install saveTestFile_API30.apk and test.
  2. Now install saveTestFile_API29.apk and test.
  3. Now install saveTestFile_API30.apk and test.

Then you will probably understand.
The aha moment should come at step 3. :wink:

Note: I have to decompile the APK from the test server (to get the correct keystore because the AI2 test server does not use the same keystore as the AI2 server).

Screenshots from step 3


1 Like

I am getting this result:

Yes, LGTM ...

Ah, I forgot to upload the latest version (including webview).
I've now updated the GD link above, so removed this link again.

@vknow360 Do you get the webwiew now (with the updated APK version)?

Yes.

In step 1 nothing was getting saved.

1 Like

Exactly, and nothing can be listed from /Documents or /Downloads.
In addition, the webview is not displayed.

So step 3 uses the permissions from step 2?

No, saveTestFile_API30.apk can no longer grant WRITE permission, but READ. (Non-media) files must have been created by the app in order to be able to access them. And this was the case with saveTestFile_API29.apk. Therefore, they are still accessible after the update.

1 Like

Files created with SDK = 29 can be accessed from SDK = 30.
So nothing will change with update for existing files.