html5 geolocation permissions from 3rd party script - html

I am creating a browser extension that injects some javascript onto certain websites.
The script's functionality requires to know if the user has geolocation enabled for the specified site or not. Thus far, I have only seen example javascript that asks for permission from a user on a site, and then makes its decision on what to do.
To be as unintrusive as possible to the user, I would like to find out if the user has already permitted the site to use its geolocation and if it has, use that information, otherwise execute the code that doesn't require it. Is there any function in the html5 geolocation api that allows me to do this?

First of all, Geolocation is NOT part of HTML5, it is a W3C specification.
Secondly, as far as I'm aware, there isn't a method of doing this. A quick look at the W3C Geolocation Specification doesn't reveal anything.
I'd suggest simply attempting to obtain their position via Geolocation anyway, if it works then you can assume permission has been granted, if not run the code that doesn't require the API.
I know you don't want to explicitly ask the user's permission, but it will only be the once so you might as well.

As far a I know, there is no such feature and I've never heard about it, so you may have to wait for a long time...

It looks like there is now a "Permissions API" that will allow you to look at what permissions have been granted to the site.
// Check for Geolocation API permissions
navigator.permissions.query({name:'geolocation'})
.then(function(permissionStatus) {
console.log('geolocation permission state is ', permissionStatus.state);
permissionStatus.onchange = function() {
console.log('geolocation permission state has changed to ', this.state);
};
});
https://developers.google.com/web/updates/2015/04/permissions-api-for-the-web
However, at this time it is not very widely supported outside of Chrome and Firefox: http://caniuse.com/#feat=permissions-api

Related

Improve permission warning for chrome.webNavigation

When using chrome.webNavigation the webNavigation permission is needed. As stated on Permission Warnings, using that permission makes the installer to show the warning message:
Read your browsing history
In my case, I only want to listen to one specific domain, let's say domain.com. So, I need to filter the callback for chrome.webNavigation.onCompleted.addListener().
Now, from the user perspective, they could distrust the chrome extension since "Read your browsing history" is too broad and the extension should only work on domain.com.
When a match pattern is used in the permissions, a message like Read and change your data on all domain.com sites and www.domain.com is used.
Is there any other way to use chrome.webNavigation and only listen to one domain? where chrome extension issues/feature requests should be sent?
Update: I had to use webNavigation in order to support AJAX calls. That is, listen to changes in the DOM and the URL made with AJAX. I solved this particular case by using a MutationObserver. Thus, I could remove the permission. The original question was already reported as a bug by Rob W.
In this case, I've already posted a feature request over a year ago: https://crbug.com/431108 ("Allow extensions to use webNavigation API without webNavigation permission").
where chrome extension issues/feature requests should be sent?
Report feature requests and bugs at https://crbug.com/new (points to https://bugs.chromium.org).
If you want to get the equivalent effect of chrome.webNavigation.onCompleted without using the webNavigation API or adding extra permissions, then you can declare a content script and send a message to the background page when the window.onload event fires.

Vimeo API: Global Privacy Settings

I believe I already know the answer to my question, but I'll throw it out there just for fun.
Is there anyway in the Vimeo Advanced API to change the global settings for an account?
I would really like to set the Embed Settings approved urls in the global side rather than having to loop through all the videos in an account to add an approved url.
Is there any way to change the global settings for a Vimeo account through the advanced API or is that going to be something implemented in the APIv3?
This is not supported in the advanced api, and may be implemented into API3 in the future.
The plan is to have support for most features on site, but each one needs to be handled securely. I can not assure you that this feature will be implemented in API3, but if you have a specific need it's worth contacting vimeo directly about it : https://vimeo.com/help/contact

Do Chrome extensions support WebSpeech API?

Do google Chrome extensions support Chrome's Web Speech speech recognition API? I have included some javascript to create a speech recognition object, but when I launch my extension, I am not prompted for microphone access.
This is not an issue with my code. I have searched on google, but I can't find any information on whether Chrome extensions support the Web Speech API. I just want a yes/no answer.
Note: I believe the WebSpeech API won't work for local files.
The Web Speech API can already be used by Chrome extensions, even in the background page and extension button popups. The fact that it works is not necessarily an intended feature, and I have previously explained how it works and why it works in this answer to How to use webrtc insde google chrome extension?. The previous explanation is about WebRTC, but it applies equally to Web Speech, and can be used as follows:
Instantiate a webkitSpeechRecognition instance and start recording.
If a permission error is detected (onerror being triggered with event.error === 'not-allowed'), open an extension page (chrome-extension://[ID]/yourpage.html). This extension page can be opened in a new window, tab or iframe.
From this page, request access to the microphone. getUserMedia and SpeechRecognition both share the (persistent) audio permission, so to detect whether audio recording is allowed, you could use getUserMedia to request the permission without activating speech recognition. For instance:
navigator.webkitGetUserMedia({
audio: true,
}, function(stream) {
stream.stop();
// Now you know that you have audio permission. Do whatever you want...
}, function() {
// Aw. No permission (or no microphone available).
});
Update: Based on RobW's answer, this answer is now out of date, and the Web Speech API is now usable inside of extensions. (Unfortunately, I can't delete this answer unless the OP un-accepts it.)
The answer is not yet. Pages accessed through chrome-extension: URLs cannot access any media-input APIs, including speechRecognition and getUserMedia. Any attempt to the use APIs will immediately trigger an error callback.
I originally thought speechRecognition could work like the geolocation API: extension popups cannot prompt for geolocation permission, but chrome-extension: pages loaded as full browser pages can prompt for permission just like a normal page. However, media APIs do not behave this way; they fail regardless of whether the page is a popup or a full page.
There is a bug report to fix this and allow developers to specify media-access permissions in the manifest. When this bug is fixed, extensions can have a manifest-set permission that grants them automatic microphone/video access, so the inability to prompt for permission will become a non-issue (and therefore extensions with appropriate manifest permissions will be able to freely use the Speech API).

what other params can I pass to the google hangout uri?

I recently discovered a parameter to pass to a google hangout uri to make it "on air": reference
I'm also wondering if I can pass any other parameters. I know that we have app_id, but I'm more interested to know if there are other parameters, such as being able to set the title or the hangout in advance, e.g.
https://plus.google.com/hangouts/_?hso=0&title=EdX%20SaaS%20Pairing
Because then I could direct people to https://plus.google.com/u/0/s/%23hangoutsonair%20EdX/hangouts and they could see all the on air hangouts associated with our MOOC. I did experimentally try passing title=, topic= and name= all to no immediate effect ...
I'd also love to know if there's a way to automatically start the live broadcast, or even better have the hangout be automatically associated with and published to our G+ pair programming community:
https://plus.google.com/communities/100279740984094902927
Many thanks in advance
Got this response from Tim Blasi at Google:
I'm a developer working on video calling. Unfortunately, you can not currently configure the video call in the way you are describing. However, we've received a lot of feedback that this is a pain point and we're currently working to address it. We'll keep your request in mind as we move forward.
https://plus.google.com/u/0/103524399391704001670/posts/JGtpxgvdD5H
resurrecting an old thread, but for a good reason.
i recently found that its possible to bypass the landing page and pre-select your user account
https://meet.google.com/lookup/my-room-name?authuser=my-email#account.com
just replace my-room-name and my-email#account.com

Geolocation without permission in manifest

Is it possible to use geolocation API in chrome extension without including the "geolocation" permission in manifest.json?
Like can we ask permission through the background.html file which runs the extension?
You can use it in a content script without declaring a permission.
This would trigger a standard notification bar asking if you want to allow current site (not your extension) to access geolocation. If user allows it, you can then pass received geolocation position to a background page for further processing.
This approach might work if your extension is injecting a content script to a single domain, otherwise user would have to allow geolocation for each domain they visit.
The code should look like:
navigator.geolocation.getCurrentPosition(function(position) {
console.log("Latitude : "+position.coords.latitude+":"+"Longitude : "+ position.coords.longitude);
});
Nope:
"An array of permissions that the extension or app might use. Each permission can be either one of a list of known strings (such as "geolocation") or a match pattern that gives access to one or more hosts. Permissions can help to limit damage if your extension or app is attacked."
http://code.google.com/chrome/extensions/manifest.html
...and here:
Your physical location "geolocation" permission Allows the extension to use the proposed HTML5 geolocation API without prompting the user for permission.
http://code.google.com/chrome/extensions/permission_warnings.html
Actually, after looking at it a bit more you can but the user will be prompted for permission:
http://www.html5rocks.com/en/tutorials/geolocation/trip_meter/
...and this page from Google says you can use this API and others:
http://code.google.com/chrome/extensions/api_other.html