On Sat, Mar 5, 2016 at 12:37 PM, Peter Bittner <[email protected]> wrote: > Oli, > > 2016-03-05 12:02 GMT+01:00 Oliver Grawert: >> a missing apparmor block is one thing, but apps that can access >> hardware without you knowing by prompting at the first access is >> definitely a critical bug. > > No, there is no prompt for microphone access in the web app. In the > plain browser there is a prompt which says, "Allow this domain access > the camera and microphone" (the final part even cut off in the German > translation). BTW, is this a joint permission, or is this request > combined "manually" in a single dialog for UX reasons?
That prompt comes from the browser (not apparmor/trust-store), and it is indeed a joint permission, which originates from a call to MediaDevices.getUserMedia() with both audio and video as constraints (see https://developer.mozilla.org/en-US/docs/Web/API/MediaDevices/getUserMedia for documentation). Denying access from that prompt should deny access to both audio and video. Thanks for filing bug #1553482, we’re looking into it. > Looks like this is really a (security) bug, because even the plain web > browser can access the microphone when you deny the permission to > access camera and microphone. You can try at e.g. > https://appear.in/test-drive on your Ubuntu phone. I've reported it at > https://bugs.launchpad.net/ubuntu/+source/webbrowser-app/+bug/1553482 > > Okay, that's one thing. Now, what about the web app? How can I make > the permission dialog pop up in the web app? See my answer on https://launchpad.net/bugs/1554202. -- Mailing list: https://launchpad.net/~ubuntu-phone Post to : [email protected] Unsubscribe : https://launchpad.net/~ubuntu-phone More help : https://help.launchpad.net/ListHelp
