broadcast intent while scanning on Android

[Carl]

Hello,

I am working on an application which relies on contact linking between
social applications. It will look into the URL field of a contact QR
code in order to map a contact on the phone to the corresponding
social contact. My application sits passively on the phone and I
believe from a user perspective, the scanning should happen with the
barcode scanner and not via my application. As such, an intent being
broadcast after a scan is a good idea. I patched up the current code.
Patch below.

Currently, the result is set in the intent being broadcast as String.
This could be better with more fine grained information. Furthermore,
a third party application which listens to scan broadcasts needs the
permission "com.google.zxing.client.android.BARCODE_SCANNED" - as any
other permission.

Index: AndroidManifest.xml
===================================================================
--- AndroidManifest.xml (revision 1177)
+++ AndroidManifest.xml (working copy)
@@ -35,6 +35,11 @@
that 1D barcodes will not be scannable, QR Codes will work. Ideally
we'd show users a message
to this effect on first launch. -->
<uses-feature android:name="android.hardware.camera"/>
+ <!-- Permission needed by other application to listen to the
barcode scanner when -->
+ <permission
android:name="com.google.zxing.client.android.BARCODE_SCANNED"
+ android:label="@string/permission_label"
+ android:description="@string/permission_description"
+ android:protectionLevel="normal" />
<application android:icon="@drawable/launcher_icon"
android:label="@string/app_name">
<activity android:name=".CaptureActivity"
Index: res/values/strings.xml
===================================================================
--- res/values/strings.xml (revision 1177)
+++ res/values/strings.xml (working copy)
@@ -104,4 +104,6 @@
<string name="share_name">Share via barcode</string>
<string name="title_about">Barcode Scanner v</string>
<string name="zxing_url">http://code.google.com/p/zxing</string>
+<string name="permission_description">Lets application listen for any
QR or barcode scans</string>
+<string name="permission_label">QR and barcode scan permission</
string>
</resources>
\ No newline at end of file
Index: src/com/google/zxing/client/android/CaptureActivity.java
===================================================================
--- src/com/google/zxing/client/android/CaptureActivity.java (revision
1177)
+++ src/com/google/zxing/client/android/CaptureActivity.java (working
copy)
@@ -335,6 +335,10 @@
* @param barcode A greyscale bitmap of the camera data which was
decoded.
*/
public void handleDecode(Result rawResult, Bitmap barcode) {
+ Intent intent = new Intent("com.google.zxing.client.android.SCAN");
+ intent.putExtra("result", rawResult.toString());
+ sendBroadcast(intent,
"com.google.zxing.client.android.BARCODE_SCANNED");
+
lastResult = rawResult;
historyManager.addHistoryItem(rawResult);
if (barcode == null) {

This can be easily tested with an application which has the following
manifest:

<application>
<receiver
android:name="QRReceiver">
<intent-filter>
<action
android:name="com.google.zxing.client.android.SCAN" />
</intent-filter>
</receiver>
</application>
<uses-permission
android:name="com.google.zxing.client.android.BARCODE_SCANNED" />

Any comments?

Regards,
Carl

[Sean Owen]

Daniel I thought it did this already? could be totally wrong.
Seems easy enough, and I see a use case for it. Is there any downside
-- apps being able to listen in on all your scans?

[Carl-Gustaf Harroch]

>> Daniel I thought it did this already? could be totally wrong.

I did a search on sendBroadcast and could not find any other then the
one I added. I am on 1175

>> Is there any downside -- apps being able to listen in on all your scans?

As long as there is a permission for it. It could be fine grained to
the type of scans - e.g. barcode/QR/contact etc... but I personally
believe such as generic permission is good enough as the user actively
decided to install the third application and was warned about the scan
permission.

2010/1/6 Sean Owen <sro...@gmail.com>:

--
Carl-Gustaf Harroch

Sent from Bracknell, Eng, United Kingdom

[Daniel Switkin]

Hi Carl,

This is an interesting idea but perhaps a longer-term one. There are
many paths through the app right now and it would take a lot of
testing to add this without breaking them.

For example, what happens if no one handles the broadcast? Does it
fall back to the current UI? What if someone does handle the broadcast
- does the user have a choice to handle it with Barcode Scanner? Even
if they do, the extra dialog and tap could be annoying.

I do appreciate the work and am not saying no, but we need to cut a
3.11 release with some minor fixes and this is a big change. Would you
mind holding off for a couple weeks?

Thanks,
Daniel

[Carl-Gustaf Harroch]

Hi Daniel,

>> For example, what happens if no one handles the broadcast?

The idea of a broadcast is not necessary to let other applications
handle the intent but rather let other application know about a
certain user/system action. There might be no application listening to
the broadcast or there could be plenty - each one receiving the intent
in terms and decide to act upon it or not. A broadcastReceiver does
not have a UI. If the application requires instant user action, it
could potentially bring up the UI while the barcode app would still be
available via the back upon. If the application acts upon all scans,
the user will probably uninstall it if considered annoying. I don't
see such scenario happening frequently. You could compare this
scenario to the intent broadcast when a SMS is received - there will
be several app listening to SMSs and acting accordingly to their
logic. I have not seen any applications which would constantly bug me
when SMSs are received.

No rush, I am not in a hurry. My 'work' was just a couple of lines so
the appreciation lies with me.

Cheers,
./Carl

2010/1/6 Daniel Switkin <dswi...@google.com>:

[Sean Owen]

(Yes scratch my earlier comment about it already doing this, thinking
of something else.)

Yeah I also wasn't sure about the nobody-handling-it problem -- so
what, right? Or else I misunderstand. I thought it was just a
broadcast for anyone who cares.

Actually my concern stands and is a different one: so now Barcode
Scanner lets everyone on the system know when you scan URLs, contact
info, bookmarks? that might not be OK at all.

We've typically told people to do it the other way -- your app invokes
the scanner. is that not feasible?

[Carl-Gustaf Harroch]

>> I thought it was just a broadcast for anyone who cares.

That's correct. The barcode app should not care about other apps
handling (or not) the intent. It just broadcasts the intent in case
anyone (like myself) is interested.

>> so now Barcode Scanner lets everyone on the system know when you scan URLs, contact info, bookmarks? that might not be OK at all.

Only application with the permission
"com.google.zxing.client.android.BARCODE_SCANNED" will be able to read
what has been scanned. When installed, the user is prompted to accept
the security risk describe in values/string.xml
(permission_description & permission_label). This is the same way
permission are enforced for reading SMS/internet/geolocation/reading
contacts and so forth. I don't see more risk here then applications
reading SMSs or accessing the net.

>> We've typically told people to do it the other way -- your app invokes the scanner. is that not feasible?

Yes I intend to do it this way for now. However I still see great
usage of such broadcasting. I am working on an app that would auto
connect a linkedin user if in the URL field of the QR code contains a
LinkedIn URL. I want the contact to be saved by the ZXing app and
myself I would link the contact while acting on the broadcasted
intent.

Hope I did make some sense.

2010/1/6 Sean Owen <sro...@gmail.com>:

--

[Sean Owen]

Yeah understood about the permissions, that does mitigate the concern
to a large degree.
I like the idea in principle.

[Carl-Gustaf Harroch]

let me know if you need any help.

Cheers for now.

2010/1/7 Sean Owen <sro...@gmail.com>:

> Yeah understood about the permissions, that does mitigate the concern
> to a large degree.
> I like the idea in principle.
>

--