[FEATURE REQUEST] Request (optional) permission to "install apps from unknown sources"

[ralfbergs]

Is your feature request related to a problem? Please describe.
I wanted to securely share an APK with my phone to install it. When I tried to install it from the OwnCloud Android client, Android offered my to open the APK with the "package installer", but nothing happened. I also couldn't manually enable the "install apps from unknown sources" feature in the OwnCloud app's settings, as the app doesn't seem to request this feature (MANIFEST?).

I was unable to download the APK to my "Downloads" folder with OwnCloud, so that I could have used the Android "Files" app to install it.

Describe the solution you'd like
I would like for the OwnCloud app to (optionally) request this permission to give users the option to install APKs they have on their OwnCloud.

Describe alternatives you've considered
Alternative would be to use some other means to download the APK to your phone, but those may potentially not be as safe as using your own trusted OwnCloud.

Additional context
N/A

TASKS

• Research (if needed)
• Create branch feature/feature_name
• Development tasks
  • Implement whatever
  • ...
  • Implement unit tests (if needed)
• Code review and apply changes requested
• Design test plan
• QA
• Merge branch feature/feature_name into master

[jesmrec]

Thanks a lot for opening!! we'll discuss about such option.

[jesmrec]

@ralfbergs thanks a lot for your feedback and for clearly explaining your use case.

The permission you are asking for is called REQUEST_INSTALL_PACKAGES

We totally get why you'd want to download and install an APK from your oC. That said, we've decided not to request the REQUEST_INSTALL_PACKAGES permission in the app. Here's why:

• It's a sensitive permission that can open the door to potential security issues if misused — even unintentionally.
• Google Play strongly discourages its use, and using it without a very specific and justified reason can cause problems with publishing or updating the app.

Besides of that, newer Android versions have made this process even trickier, with more restrictions and less predictable behaviour across devices.

By using the Android’s Storage Access Framework (SAF) you will be able to download files (including APKs) directly to your Downloads folder or wherever you choose, as you mentioned in the issue description.

In the past, that permission was active in the app, but it was finally removed because the risks it carries out. That was the issue: #3648

Some background about that permission:

https://support.google.com/googleplay/android-developer/answer/12085295?hl=en
https://support.google.com/googleplay/android-developer/answer/9888170?hl=en

It's not in our plans to revert it. However, the proposal about moving a file to Downloads could be feasible and would save one step to final users.

[ralfbergs]

We totally get why you'd want to download and install an APK from your oC. That said, we've decided not to request the REQUEST_INSTALL_PACKAGES permission in the app. Here's why:
[...]

Thank you for the very sensible response.

I wasn't aware of the massive restrictions put in place by Google, but they definitely make sense, so I fully share your view and the decision made.

Maybe it's possible to let the OC APP download to the Downloads folder, that would be sufficient and a big help already.