New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Excessive permissions for google drive integration #508

Open

expipiplus1 opened this issue Jan 19, 2021 · 1 comment

expipiplus1 commented Jan 19, 2021

This app requests three permissions:

View and manage files opened or created with this app
See, edit, create, delete all google drive files
See, edit, create, delete your spreadsheets in google drive

The last two seem unnecessary and are a little frightening!

Owner

helloworld1 commented Jan 19, 2021

Those are the scope requested:
https://github.com/helloworld1/AnyMemo/blob/master/app/src/main/java/org/liberty/android/fantastischmemo/common/AMEnv.java#L50

https://www.googleapis.com/auth/plus.login -> For login
https://docs.google.com/feeds/ -> For legacy API listing files, probably not needed anymore
https://docs.googleusercontent.com/ -> For legacy API reading files, probably not needed
https://spreadsheets.google.com/feeds/ -> For operating spreadsheets. This is the one showing "See, edit, create, delete your spreadsheets in google drive"
https://www.googleapis.com/auth/drive.file -> That is the one showing "See, edit, create, delete all google drive files"

We may need to figure out the correct scope to limit the permission.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment