Android Question Critical Permissions - android.permission.RECEIVE_SMS

Marcos Alves

Well-Known Member
Licensed User
Longtime User
Hello all,

I have a problem here... as most of you must to know, Google recently decided that it's dangerous to allow apps to access Call Log and SMS (for me, it's much more dangerous to give access to camera and microphone, for example... but, who knows?).
One of my apps is using sms to authenticate the phone number and intent in order to automatize the reception of the code. As B4A don't have yet a lib to the SMS Retriever API (recommend by Google as alternative method), I removed all SMS authorization from manifest and the run time permissions for SMS also, but Google is still identifying the request somewhere in my app when I try to publish. Why? I understand that the permissions list is in the manifest no? Is there any library adding this permission request when I compile the app?
I think that this is a very important subject matter because many of apps could be banned from google play due this problem...

This is my Manifest (notice the comment in SMS lines):

B4X:
'This code will be applied to the manifest file during compilation.
'You do not need to modify it in most cases.
'See this link for for more information: https://www.b4x.com/forum/showthread.php?p=78136

SetApplicationAttribute(android:largeHeap,"true")
AddManifestText(
<uses-sdk android:minSdkVersion="10" android:targetSdkVersion="26"/>
<supports-screens android:largeScreens="true"
    android:normalScreens="true"
    android:smallScreens="true"
    android:anyDensity="true"/>)
SetApplicationAttribute(android:icon, "@drawable/icon")
SetApplicationAttribute(android:label, "$LABEL$")
'AddPermission(android.permission.RECEIVE_SMS)
'AddReceiverText(smsdetect,
'<intent-filter>
'    <action android:name="android.provider.Telephony.SMS_RECEIVED" />
'</intent-filter>)

AddPermission(android.permission.ACCESS_FINE_LOCATION)
AddPermission("android.permission.READ_CONTACTS")
AddPermission("android.permission.WRITE_CONTACTS") 'if write access is required
AddPermission("android.permission.READ_EXTERNAL_STORAGE")
AddPermission("android.permission.WRITE_EXTERNAL_STORAGE")
'End of default text.

'### Conference
AddPermission(android.permission.CAMERA)
AddPermission(android.permission.RECORD_AUDIO)
AddPermission(android.permission.MODIFY_AUDIO_SETTINGS)

'### Theme fix
CreateResourceFromFile(Macro, Themes.DarkTheme) 'or Themes.LightTheme

'### Counter on ShortCut (Badge)
'# Samsung
AddPermission(com.sec.android.provider.badge.permission.READ)
AddPermission(com.sec.android.provider.badge.permission.WRITE)
'## HTC
AddPermission(com.htc.launcher.permission.READ_SETTINGS)
AddPermission(com.htc.launcher.permission.UPDATE_SHORTCUT)
'## Sony
AddPermission(com.sonyericsson.home.permission.BROADCAST_BADGE)
'### Apex
AddPermission(com.anddoes.launcher.permission.UPDATE_COUNT)
'## Solid
AddPermission(com.majeur.launcher.permission.UPDATE_BADGE)
'## Huawei
AddPermission(com.huawei.android.launcher.permission.CHANGE_BADGE)
AddPermission(com.huawei.android.launcher.permission.READ_SETTINGS)
AddPermission(com.huawei.android.launcher.permission.WRITE_SETTINGS)

AddApplicationText(
  <provider
  android:name="android.support.v4.content.FileProvider"
  android:authorities="$PACKAGE$.provider"
  android:exported="false"
  android:grantUriPermissions="true">
  <meta-data
  android:name="android.support.FILE_PROVIDER_PATHS"
  android:resource="@xml/provider_paths"/>
  </provider>
)
CreateResource(xml, provider_paths,
   <external-files-path name="name" path="shared" />
)

'CreateResource(xml, provider_paths,
'   <external-files-path name="name" path="notification" />
')

AddActivityText(Chats,
<intent-filter>
<action android:name="android.intent.action.SEND" />
<category android:name="android.intent.category.DEFAULT" />
<data android:mimeType="text/plain" />
<data android:mimeType="image/*" />
<data android:mimeType="audio/*" />
</intent-filter>)

AddApplicationText(
<meta-data android:name="AbtoVoipAuthority" android:value="com.comten.nexphone.db" />
<provider
android:name="org.abtollc.db.DBProvider"
android:authorities="com.comten.nexphone.db"
android:exported="false" />
)

AddApplicationText(
<meta-data android:name="AbtoVoipAuthrority"
    android:value="com.comten.nexphone.db" />)

AddManifestText(
<uses-feature android:name="android.hardware.wifi"
    android:required="false"/>)
AddManifestText(
<uses-feature android:name="android.hardware.microphone"
    android:required="true"/>)
AddManifestText(<uses-feature android:name="android.hardware.audio.output"     android:required="true"/>)
'AddManifestText(<uses-feature android:name="android.hardware.audio.pro"     android:required="true"/>)
AddManifestText(
<uses-feature android:name="android.hardware.touchscreen"
    android:required="false"/>)
AddManifestText(
<uses-feature android:name="android.hardware.bluetooth"
    android:required="false"/>)
AddManifestText(
<uses-feature android:name="android.hardware.portrait"
    android:required="false"/>)
AddManifestText(
<uses-feature android:name="android.hardware.camera"
    android:required="false"/>)
AddManifestText(
<uses-feature android:name="android.hardware.camera.autofucs"
    android:required="false"/>)
AddManifestText(
<uses-feature android:name="android.hardware.camera.flash"
    android:required="false"/>)
AddManifestText(
<uses-feature android:name="android.hardware.camera.front"
    android:required="false"/>)

SetActivityAttribute(image_edit, android:windowSoftInputMode, adjustPan|stateHidden)
SetActivityAttribute(profile, android:windowSoftInputMode, adjustPan|stateHidden)
SetActivityAttribute(place_add, android:windowSoftInputMode, adjustPan|stateHidden)
'SetActivityAttribute(chat, android:windowSoftInputMode, adjustPan|stateHidden)
SetActivityAttribute(showimage, android:screenOrientation, "unspecified")


AddPermission(android.permission.INTERNET)
AddPermission(android.permission.ACCESS_WIFI_STATE)
AddPermission(android.permission.ACCESS_NETWORK_STATE)
AddPermission(android.permission.READ_PHONE_STATE)
AddPermission(android.permission.WAKE_LOCK)
AddPermission(android.permission.DISABLE_KEYGUARD)
AddPermission(android.permission.VIBRATE)
AddPermission(android.permission.USE_SIP)
AddPermission(android.permission.CONFIGURE_SIP)
AddPermission(android.permission.READ_CONTACTS)
AddPermission(android.permission.WRITE_CONTACTS)
AddPermission(android.permission.READ_PROFILE)
AddPermission(android.permission.READ_EXTERNAL_STORAGE)
AddPermission(android.permission.WRITE_EXTERNAL_STORAGE)
AddPermission(android.permission.BROADCAST_STICKY)
AddPermission(android.permission.MODIFY_AUDIO_SETTINGS)
AddPermission(org.abtollc.db.permRead)


AddManifestText(<uses-feature android:name="android.hardware.location.gps"/>)

SetApplicationAttribute(android:name, "org.abtollc.sdk.AbtoApplication")

AddApplicationText(
<service
    android:name="org.abtollc.service.ABTOSipService"
    android:exported="true">
    <intent-filter>
        <action android:name="org.abtollc.service.ABTOSipService" />
        <action android:name="org.abtollc.service.SipConfiguration" />
    </intent-filter>
</service>)

CreateResourceFromFile(Macro, FirebaseAnalytics.GooglePlayBase)
CreateResourceFromFile(Macro, FirebaseAnalytics.Firebase)
CreateResourceFromFile(Macro, FirebaseNotifications.FirebaseNotifications)
'CreateResourceFromFile(Macro, FirebaseAnalytics.FirebaseAnalytics)
'CreateResourceFromFile(Macro, FirebaseAuth.FirebaseAuth)

CreateResourceFromFile("google-services", "google-services.json")

'************ Google Play Services Base ************
AddApplicationText(
   <activity android:name="com.google.android.gms.common.api.GoogleApiActivity"
  android:theme="@android:style/Theme.Translucent.NoTitleBar"
  android:exported="false"/>
    <meta-data
  android:name="com.google.android.gms.version"
  android:value="@integer/google_play_services_version" />
)
'************ Google Play Services Base (end) ************
 

DonManfred

Expert
Licensed User
Longtime User
As B4A don't have yet a lib to the SMS Retriever API (recommend by Google as alternative method)
should not be difficult to write one. As far as i know there is not much needed.
Plus a setting in manifest for the broadcast and setting up a briadcastreceiver.
 
Upvote 0

Marcos Alves

Well-Known Member
Licensed User
Longtime User
click the list permissions button in the log tab
It looks that it's generated by phone library, which could be a problem because I use many methods of phone to know the Android Version and serial... I done a workaround to publish:
  • Compiled...
  • Edited the AndroidManifest.xml file removing <uses-permission android:name="android.permission.SEND_SMS"/>
  • Marked this file as read-only in windows
  • Cleaned the compilation
  • Compile again
As I don't call SMS methods of the phone lib, I'll not get any error... but it's really a poor workaround no?
 
Upvote 0

Marcos Alves

Well-Known Member
Licensed User
Longtime User
but you are using PhoneSMS it seems. The library adds the permission. Remove the library.

But you are now asking another question
I cant' remove phone lib... I use methods to check Android version, volume level and others... but no SMS.
 
Upvote 0

Marcos Alves

Well-Known Member
Licensed User
Longtime User
@DonManfred ... this solution works fine... but, do you know any other?
 
Upvote 0

Marcos Alves

Well-Known Member
Licensed User
Longtime User
 
Upvote 0

DonManfred

Expert
Licensed User
Longtime User
Do you have an api which could send a sms to my device after i requested it with a httpcall for ex?

i need to get a SMS in a specific format with a specific signature... I found an online site where i can send a sms but the captcha i boring and it does not provide copy and paste so i need to enter the sms manually...

Reason is that i wrote a wrapper for the SMS Retriever api and need to test it now
 
Upvote 0

Marcos Alves

Well-Known Member
Licensed User
Longtime User
Yes.

1. The Phone library will not add the SMS permission. Only when you dim a PhoneSms object will the permission added. Search your code for PhoneSms.

2. Use RemovePermission to remove a permission.
Thanks @Erel . I'll search for the "Dim PhoneSMS"
 
Upvote 0

Marcos Alves

Well-Known Member
Licensed User
Longtime User
Hello @DonManfred . Yes, we have an internal api to send SMS messages. Besides we have our own SMS servers, we also parse external service providers with their own API's... A SMS service that I recommend today is Nexmo ( www.nexmo.com ) . You can do a small refill with PayPal and can test with their API directly...
By the way, I can send a payment to collaborate with your SMS Retrieve wrapper... give me your PayPal address

Regards.
 
Upvote 0

Marcos Alves

Well-Known Member
Licensed User
Longtime User
not only you ;-) I already spent around 10 hours to get it working

Thank you for your donation! Really appreciated!
You're welcome! Only a small donation, but also a hope that I can incentive this behavior to support innovative and dedicated developers like you.
 
Upvote 0
Cookies are required to use this site. You must accept them to continue using the site. Learn more…