[Bug]: Camera plugin allows to access the photo gallery and pick the photo(s) even if the user has not granted the required permission

[ryaa]

Capacitor Version

💊 Capacitor Doctor 💊

Latest Dependencies:

@capacitor/cli: 5.7.2
@capacitor/core: 5.7.2
@capacitor/android: 5.7.2
@capacitor/ios: 5.7.2

Installed Dependencies:

@capacitor/ios: not installed
@capacitor/cli: 5.7.2
@capacitor/android: 5.7.2
@capacitor/core: 5.7.2

Other API Details

alexryltsov@Alexs-MacBook-Pro-2 master % npm --version
10.5.0
alexryltsov@Alexs-MacBook-Pro-2 master % node --version
v20.11.1
alexryltsov@Alexs-MacBook-Pro-2 master % pod --version
Ignoring ffi-1.15.5 because its extensions are not built. Try: gem pristine ffi --version 1.15.5
Ignoring ffi-1.15.5 because its extensions are not built. Try: gem pristine ffi --version 1.15.5
1.15.2

Platforms Affected

• iOS
• Android
• Web

Current Behavior

When the user chooses to pick images/photos and does not grant the permission to access the gallery, the camera plugin ignores this and allows to access the images/photos in the gallery - see here

Please note that camera plugin taking photos feature does respect the permission.

For the detailed reproduction scenario please see https://github.com/ryaa/camera-pick-images-denied-permission-ignored

Expected Behavior

My assumption is that the behavior should be consistent for both the photo picker and the camera. The user should not be allowed to select a photo from the gallery if the permission has not been granted.

Project Reproduction

https://github.com/ryaa/camera-pick-images-denied-permission-ignored

Additional Information

The problem seems to be because the permission callback simply opens the photo gallery and ignores the denied permission status - see https://github.com/ionic-team/capacitor-plugins/blob/5.x/camera/android/src/main/java/com/capacitorjs/plugins/camera/CameraPlugin.java#L244
Here is the PR with a potential fix - see ionic-team/capacitor-plugins#2052

It also seems that this issue might be fixed in Capacitor 6.x

[jcesarmobile]

Android doesn't really require permissions for picking images nor for taking pictures.

But there is an Android bug that if the app has the permission Camera permission present, as you have, then it has to prompt it. But if you remove it, it won't prompt it and still work.

And for picking images there is also a bug in some Android devices (Samsung mostly) where the permission is needed but it's not possible to know which devices are affected, so the plugin requests the permission for all and tries to continue, if the user didn't grant the permission, but the device doesn't need the permissions then it proceed, if the device needs the permission then it will return an error. I agree that it makes a confusing flow.

As you said, this is fixed in Capacitor 6. So closing.

[ryaa]

Confirming that the issue does not occur after upgrading to Capacitor 6.

[ionitron-bot]

Thanks for the issue! This issue is being locked to prevent comments that are not relevant to the original issue. If this is still an issue with the latest version of Capacitor, please create a new issue and ensure the template is fully filled out.