Android: Fix WebView access to geolocation data.

Webapps dependent on geolocation fails even if ACCESS_FINE_LOCATION
permission is set by developer for the package itself. This fix
implements implicit user prompt to allow access to geolocation
data if ACCESS_FINE_LOCATION permission is set. From now on,
QtWebView adds ACCESS_FINE_LOCATION by default to make it work out
of the box. Packages built without ACCESS_FINE_LOCATION (if developer
removes it manally) will not (naturally) get access to device
location as before this fix, nor there will be Android security
exceptions.

Task-number: QTBUG-49566
Change-Id: I476aef28e59f238a571ed77984b9cd294a9bbd25
Reviewed-by: Christian Stromme <christian.stromme@theqtcompany.com>

1 files changed, 21 insertions, 0 deletions

diff --git a/src/jar/src/org/qtproject/qt5/android/view/QtAndroidWebViewController.java b/src/jar/src/org/qtproject/qt5/android/view/QtAndroidWebViewController.java
index a2b5c7b..2023df9 100644
--- a/src/jar/src/org/qtproject/qt5/android/view/QtAndroidWebViewController.java
+++ b/src/jar/src/org/qtproject/qt5/android/view/QtAndroidWebViewController.java
@@ -36,6 +36,9 @@
 
 package org.qtproject.qt5.android.view;
 
+import android.content.pm.PackageManager;
+import android.view.View;
+import android.webkit.GeolocationPermissions;
 import android.webkit.ValueCallback;
 import android.webkit.WebView;
 import android.webkit.WebViewClient;
@@ -56,6 +59,7 @@ public class QtAndroidWebViewController
 {
     private final Activity m_activity;
     private final long m_id;
+    private boolean m_hasLocationPermission;
     private WebView m_webView = null;
     private static final String TAG = "QtAndroidWebViewController";
     private final int INIT_STATE = 0;
@@ -169,6 +173,12 @@ public class QtAndroidWebViewController
             super.onReceivedTitle(view, title);
             c_onReceivedTitle(m_id, title);
         }
+
+        @Override
+        public void onGeolocationPermissionsShowPrompt(String origin, GeolocationPermissions.Callback callback)
+        {
+            callback.invoke(origin, m_hasLocationPermission, false);
+        }
     }
 
     public QtAndroidWebViewController(final Activity activity, final long id)
@@ -180,6 +190,7 @@ public class QtAndroidWebViewController
             @Override
             public void run() {
                 m_webView = new WebView(m_activity);
+                m_hasLocationPermission = hasLocationPermission(m_webView);
                 WebSettings webSettings = m_webView.getSettings();
 
                 if (Build.VERSION.SDK_INT > 10) {
@@ -195,6 +206,9 @@ public class QtAndroidWebViewController
                     } catch (Exception e) { /* Do nothing */ e.printStackTrace(); }
                 }
 
+                //allowing access to location without actual ACCESS_FINE_LOCATION may throw security exception
+                webSettings.setGeolocationEnabled(m_hasLocationPermission);
+
                 webSettings.setJavaScriptEnabled(true);
                 if (m_webSettingsSetDisplayZoomControls != null) {
                     try { m_webSettingsSetDisplayZoomControls.invoke(webSettings, false); } catch (Exception e) { e.printStackTrace(); }
@@ -424,4 +438,11 @@ public class QtAndroidWebViewController
             public void run() { try { m_webViewOnResume.invoke(m_webView); } catch (Exception e) { e.printStackTrace(); } }
         });
     }
+
+    private static boolean hasLocationPermission(View view)
+    {
+        final String name = view.getContext().getPackageName();
+        final PackageManager pm = view.getContext().getPackageManager();
+        return pm.checkPermission("android.permission.ACCESS_FINE_LOCATION", name) == PackageManager.PERMISSION_GRANTED;
+    }
 }