New version asks too many permissions about newtab-redirect HOT 23 CLOSED

These are required for the new tab apps page.

Chrome doesn't offer read only permissions, which is stupid. Browsing
history had always been there as part of the chrome.tabs permissions.
On Mar 6, 2014 6:30 PM, "matteosistisette" [email protected] wrote:

After an automatic update, New Tab Redirect got disabled because the new
version needs more permissions. So I got the warning prompting me to accept
the new permissions in order to reenable it.

So far so good, but most of the permissions are totally unnecessary to do
what the plugin is supposed to do, which is simply open the home page on
every new tab you open. I may understand "access the icons of the websites
you visitu" but it shouldn't need to read the browsing history, let alone
modify it!! Read and modify your bookmarks?!? Manage your apps, extensions
and themes???!!!??
[image: screenshot from 2014-03-07 00 17 00]https://f.cloud.github.com/assets/542107/2352253/532858c4-a587-11e3-8309-561c0f6055b4.png

Reply to this email directly or view it on GitHubhttps://github.com//issues/39
.

from newtab-redirect.

There's a more in-depth discussion about the permissions here (https://github.com/jimschubert/NewTab-Redirect/wiki#wiki-version-30-permissions) (this is also linked on the descriptions page of the extension in the store).

It's explained fairly clearly in the changelog:

 * Added permissions:
    - "topSites": required to display top 10 visited sites
    - "management": required to allow user to display, launch, and
       uninstall Chrome apps within built-in new tab page
    - "bookmarks": required to display first 10 bookmarks bar links
    - "chrome://favicon/": required to display bookmark icons

Here's chrome's documentation for permissions: http://developer.chrome.com/extensions/permission_warnings

And the permissions for this extension are declared here.

Specifically:

• tabs: Access your tabs and browsing activity
• storage (causes no warnings)
• topSites: Read and modify your browsing history
• management: Manage your apps, extensions, and themes
• bookmarks: Read and modify your bookmarks
• "chrome://favicon": (causes no warnings)

After reviewing the permissions, I've noticed that tabs create and update no longer require permissions (it's been there since before Chrome 7 when this changed, and I've never had reason to verify the permission before). So, I could have technically removed that permission between version 0.0.1 and version 2.2 of this extension, but would have needed to add it back to open apps in a new window. It's the management, bookmarks, and topSites using terminology like "manage" and "modify" that I think scares people, but I like I said, Chrome doesn't allow read-only access.

Although the new functionality is cleanly and concisely wrapped in services.js where anyone can review the fact that I'm not actually modifying anything, I've had many people insulting me and accusing me of stealing their data. Trust me, I have better things to do than to worry about what people are doing on the internet. I know where to find porn and pictures of cats myself and I imagine the other 20% of what people do online is Facebook.

Here are photos of the new Apps page: https://www.dropbox.com/sh/3yxfmbm5dpuw747/INZW44gbA3#/

I'm leaving this open even though it's not a bug.

Thanks.

from newtab-redirect.

I have the newest version installed, it looks GREAT. I don't care about the permissions, in fact I have so many extentions that my data is probably being reported everywhere. I don't care though, I have AdBlock Plus (and AdBlock), and I have no money anyway to spend...
On the complaints side, my only complaint is it does not inherit the sort order used on chrome://apps/.
As a side note, the last sentence in this section contains a spelling error: you have write instead of right

from newtab-redirect.

Thanks, its always good to hear users like what I've done.

I'm not sure how Chrome sorts apps in chrome://apps. If I recall, they
don't use the same query as extensions use.

I previously had 85 apps installed. I reduced it to 65. The filter makes it
really easy to find apps by name.

I will look at Chrome's source to see how apps are ordered. They may not
make the ordering data available to me, though.
On Mar 7, 2014 8:07 AM, "Walkman - Matthew Carter" [email protected]
wrote:

I have the newest version installed, it looks GREAT. I don't care about
the permissions, in fact I have so many extentions that my data is probably
being reported everywhere. I don't care though, I have AdBlock Plus (and
AdBlock), and I have no money anyway to spend...
On the complaints side, my only complaint is it does not inherit the sort
order used on chrome://apps/.

Reply to this email directly or view it on GitHubhttps://github.com//issues/39#issuecomment-37022198
.

from newtab-redirect.

I'm almost done with modifications to make the required permissions of version 3.0 optional and individually configurable (if you use the new apps page). see issue #41

from newtab-redirect.

Marked this as a bug (users don't expect these optional permissions to be required). This will be the major fix for version 3.1.

from newtab-redirect.

Beta testing for New Tab Redirect 3.1 is starting next week. Users can join the Google Group to participate.

I've redesigned the options page and provided the ability to grant/deny individual permissions used by the 'Apps' page.

I've also added the ability to grant/deny permissions for the 'Apps' page in the display options of the page.

from newtab-redirect.

Ok I've (finally) got round to testing the Beta, so far everything in the options page works except for the links on the left (URL, Permissions, Donate). Everything else in the page works (permissions buttons, URL auto-set links). If I may, I suggest you link the Google+ and Twitter in the Donate section to your actual accounts (yes, I am that lazy :P)
The New Tab Redirect apps page works, the settings popup too.
Two questions: what if I were to enable both the NTR Beta and the main one? also, from what I can see, the 'tabs' permission is only required to open a link in a new window? with the permission denied, NTR Beta still manages opening links in a new tab fine, with no option for opening in a new window... bizarre. you'd think the permission would be named 'windows' or something. lol
BTW, I'm using Chrome 33.0.1750.154 (Official Build 257193) m on Windows 7 HP SP1

from newtab-redirect.

Thanks for providing so much detail.

I'm confused a bit by your comments about the options page. If the links
on the left (URL, Permissions, Donate) don't work, how are you seeing the
permissions buttons and donate section? Is the styling of these
pseudo-side-tabs odd because they look like links when you hover over them,
leading to confusion they should open some other page? Based on your
comment, I now think it'd be better if the text was only black and probably
expand a little when hovering over the item. The options page is basically
a single-page application written with AngularJS, so you'll never see more
than a small region of the page get updated at any given time.

I've added a feature request based on your comment about the donate section
(#49). I'll plan to
add a contact section for version 3.2. Although it would be a relatively
simple fix, I don't want to add anything new to the version 3.1 that might
push back releasing it. It's a great suggestion, thanks!

If you have both version of New Tab Redirect installed (store version, beta
version), Chrome will just choose which one executes. It appears to be
randomly chosen. You'd think Google would warn you or something when two
extensions override the same page.

The tabs permission is really weird. When I first wrote New Tab Redirect,
the tabs permission was required to get the id of the current tab and
update the location of the current tab. At some point the API was changed
(or it could have been improperly documented in 2009) so that you didn't
need the tabs API to create or update a tab. I was never informed of this,
so I only realized for version 3.0 that I could have removed the tabs
permission for a long time. You're correct, though, that it's required to
open a new window. Maybe Google/Chromium developers decided an additional
'windows' permission would confuse users, so they grouped it with tabs?
There's a lot of wonky grouping of permissions (like topSites and
bookmarks).

On Fri, Mar 28, 2014 at 5:53 PM, Walkman - Matthew Carter <
[email protected]> wrote:

Ok I've (finally) got round to testing the Beta, so far everything in the
options page works except for the links on the left (URL, Permissions,
Donate). Everything else in the page works (permissions buttons, URL
auto-set links). If I may, I suggest you link the Google+ and Twitter in
the Donate section to your actual accounts (yes, I am that lazy :P)
The New Tab Redirect apps page works, the settings popup too.
Two questions: what if I were to enable both the NTR Beta and the main
one? also, from what I can see, the 'tabs' permission is only required to
open a link in a new window? with the permission denied, NTR Beta still
manages opening links in a new tab fine, with no option for opening in a
new window... bazarre. you'd think the permission would be named 'windows'
or something. lol
BTW, I'm using Chrome 33.0.1750.154 (Official Build 257193) m on Windows 7
HP SP1

Reply to this email directly or view it on GitHubhttps://github.com//issues/39#issuecomment-38972318
.

[email protected]
H (507) 724-8237
C (804) 921-7331

from newtab-redirect.

Thank-you for your reply. From what you have said, I think the options page is presented nowhere near like it should - I see all the sections on one page, with the URL, Permissions and Donate link on the left that do nothing.



It's one long page, the links on the left stay at the top of the page and don't do anything.

from newtab-redirect.

That's definitely not how it's supposed to look.

I've double-checked in Linux, Windows, and Mac... all are paged for me.

Can you hit CTRL+SHIFT+i and see if there are any console errors on this page? If not, holding CTRL+SHIFT while you reload the page will force a reload of JavaScript and stylesheets. I'm not sure this will change anything, though. These 'pages' use the AngularJS ng-show which displays the element based on the selected 'tab' condition, for example ng-show="selected=='donate'". Something would have to cause 'selected' to equal all three of the pages at the same time, which is impossible. The weird thing is that if AngularJS wasn't working, the link displays and grant/deny permissions buttons wouldn't work either.

from newtab-redirect.

So, I've tested on Windows with versions 33.0.1750.146 (Official Build 254388) m and Chrome 33.0.1750.154 (Official Build 257193) m. I still see paging on the options page. I noticed while trying to reproduce what you're seeing that all javascript files are transferred as text/plain under Windows with the latest version of Chrome instead of the application/javascript I see on my Linux machine. I'd have to dig deeper to see if this is happening across the board. If so, I'd say it's a bug in Chrome. I'm not sure why it would cause different display for the two of us, though.

edit: I just confirmed, this version of Chrome transfers all javascripts in all my installed extensions as text/plain. This shouldn't be a problem, but it's very peculiar.

from newtab-redirect.

using CTRL+SHIFT+I I only see a warning:

event.returnValue is deprecated. Please use the standard event.preventDefault() instead.

After holding CTRL+SHIFT and reloading, the page content loads in a second to exactly the same as before, and the images take a few seconds to load and it leaves the page exactly the same as before, with the same console warning.
Should I post the source code of NTRs options page?
Below the footer, all the scripts show:

<script type="text/javascript" src="js/vendor/jquery/jquery-1.10.2.min.js"></script>
<script type="text/javascript" src="js/vendor/angular/angular.min.js"></script>
<script type="text/javascript" src="js/controllers.js"></script>
<script type="text/javascript" src="js/options_constants.js"></script>
<script type="text/javascript" src="js/options_controller.js"></script>
<script type="text/javascript" src="js/directives.js"></script>
<script type="text/javascript" src="js/filters.js"></script>
<script type="text/javascript" src="js/services.js"></script>
<script type="text/javascript" src="js/app.js"></script>

from newtab-redirect.

Can you uninstall the beta and reinstall it to see if the problem still exists? I will test in the Windows VM on my work machine tomorrow.

If it does still exist, I will add some console log statements and push to the beta tomorrow. Technically, the page works, but I'd rather find out why the page isn't hiding elements as they should be.

from newtab-redirect.

I noticed while trying to investigate this under Linux that the ng-hide css class applied by the ng-show directive was 'applied' by a rule on options.html:144.. but there is only one in-page style for the body element. The rule actually does not exist in the stylesheets on the page, although it should. This ng-hide style is angularjs specific, and I'm not sure why the style would be applied if it was missing from the options page's stylesheet. I've seen a few chrome extensions from Google being written in AngularJS (like the Chromecast extension), and I wonder if the browser might automatically insert these stylesheet rules (there are only two). I'm going to add the rules explicitly to see if that resolves the issue for you.

I'm going to go ahead and add the contact link as you suggested earlier and push these changes to the beta.

from newtab-redirect.

I've uninstalled the beta, I'm trying to reinstall now. When you say you are going to push the changes to the beta, does that mean you will push to the Chrome Webstore too?

from newtab-redirect.

Yeah, I made the changes and pushed them to the beta version on the Web Store accessible to testers (via the Google Group membership). Publishing to the web store usually takes between 5 minutes and an hour, but I've already received the updates. It's still working the same as it did before for me, but I think adding the stylesheet rule would fix your issue.

from newtab-redirect.

Alright, finally finished installing the beta, chrome://extensions shows it is version 3.1.1, and yay! options page works perfectly!
[Sorry about the comments mess yesterday, my internet was incredibly slow]
The new tab page with no permissions granted and permissions granted looks good, welcome looks good, options looks good. Now all I can ask is for integration with themes :P should I open a new issue?

from newtab-redirect.

Awesome, it must have just been the implied style rule.

I've looked into themes integration and didn't see a way for new tab
override pages to use themes. I can open an issue to track its development.

Have you installed other extensions that support themes?
On Mar 31, 2014 11:48 AM, "Walkman - Matthew Carter" <
[email protected]> wrote:

Alright, finally finished installing the beta, chrome://extensions shows
it is version 3.1.1, and yay! options page works perfectly!
[Sorry about the comments mess yesterday, my internet was incredibly slow]
The new tab page with no permissions granted looks good, welcome looks
good, options looks good. Now all I can ask is for integration with themes
:P should I open a new issue?

Reply to this email directly or view it on GitHubhttps://github.com//issues/39#issuecomment-39104473
.

from newtab-redirect.

No, I have not, but the only thing that [my] theme changes on the stock NTP is the background picture. I'm not sure if it is the same with all themes, but I remember seeing it in the code. I'll check now

from newtab-redirect.

The image that my theme uses as a background is at:

chrome-search://theme/IDR_THEME_NTP_BACKGROUND?bdfkbdkkfmmckaadapdipihjfaacnkgd

to find out what the theme id is, presumably wouldn't be incredibly difficult, since we have already granted access to 'apps, extensions and themes'. I don't know much about JavaScript and HTML myself (aulthough I do know a bit), but I'm guessing you could check for an installed theme, get the id, then display the image in the background. If there is no background, or if the image isn't found, it could default back to the original background (rgba(250,250,250,1))

from newtab-redirect.

I remember now... the chromium team considers whitelisting chrome://themes a security flaw: https://code.google.com/p/chromium/issues/detail?id=11854

from newtab-redirect.

I've just released version 3.1 to the public. It should be updated within the next few hours.

This version will allow users who don't need the permissions to remove all of them with a single button click. I've also added the ability to remove all permissions individually on the options page and on the display settings dialog in the new Apps page. This way, users who don't want bookmarks or top sites can remove one or both of them while still having the apps visible.

from newtab-redirect.